kvm-it 0.4.5: recording, themes, honest video and buttons (host-tested)

Read this first

• Host-tested, not hardware-verified. Everything below was built and tested on a Linux host (unit tests, clippy, and the recorder against a real ffmpeg on synthetic frames). Nothing was run against a capture card, an adapter or a real target, and neither colour theme nor the Record button has been looked at on a real screen. The open hardware checks are tracked in issues #31–#34.
• Signing: kvmit.exe, kvmit-gui.exe and the MSI are code-signed by the release workflow (Azure Artifact Signing; Authenticode status Valid, signer CN=Joseph Spillers, from SIGNATURES.txt), and verify-release.py --require-signed passes on the published assets. There is no Linux AppImage in this release (the workflow does not build it); use 0.4.0's, or build from source.
• No firmware change. Firmware 0.2.0 and protocol 1.1 are exactly 0.4.0's. The Secure Boot boot-drive work (PR #15) is not in this release.
• Review: four rounds of adversarial review (Codex gpt-6-astra), every finding confirmed and fixed (docs/dev-process.md, rounds 17–20). The last fix (an atomic, no-replace publish of finished recordings) has not had a further review round, so no sign-off is claimed.

What's new (0.4.1 to 0.4.5, rolled into one release)

Session recording (new). ● Record… in the top bar: GIF (silent, about 12 fps, at most 960 px wide, stops after 30 s) or WebM (VP9, up to 30 fps, sound only if you pick an input, off by default). The popup warns that a recording cannot be redacted. While recording, a red ● REC mm:ss, click to stop chip stays live even while input is captured. Files go to ~/Videos/kvm-it/, timestamped, never overwriting; quitting finishes the file. Needs ffmpeg on your PATH.

Light and dark theme. A Theme button cycles auto (follows your system, the default), light and dark, and remembers the choice. Status colours are chosen per mode and held to WCAG AA contrast by tests.

The video chip tells the truth (Linux).

• A card that is unplugged or stops delivering is detected: the chip no longer stays green on a frozen frame, and a failed start is reported.
• Closing a stalled capture can no longer hang the window.
• The chip shows the frame rate the card was actually set to; the pixel format the driver applied is honoured, and YUYV rows are read with the driver's stride.
• A flat, blank picture shows an amber Video: no signal, and the picture area says so (a genuinely black screen reads the same; you can still record it).
• A fresh install no longer opens the first video device (often a webcam); only a remembered card opens, and it is remembered by a stable key, not /dev/videoN.

Buttons and feedback.

• Type keeps your text if the run does not start, and flags characters it cannot type before you click.
• Capture with no adapter or during a script says why, instead of doing nothing.
• The run-log header says what happened: Finished, Dry run finished, Aborted: reason, or Failed: reason.
• Notices can be dismissed and expire; the adapter link error has its own line.
• Dry run works without an adapter. Target USB is a label, not a button. Disabled controls say why on hover.
• Esc aborts a running script and releases every key (not while you are typing in a text field). The mouse wheel honours touchpad pixel scrolling instead of sending dozens of notches.

Known limits

• Linux hardware behaviour of the video changes, recording from a real card, capture-card audio sync, the touchpad feel (40 points per notch is a guess) and the YUYV colour matrix are all unverified (#31–#34).
• A recording that cannot be encoded fast enough repeats frames to keep real time; the notice reports how many were dropped.
• Windows: recording and the new code paths are compile-checked for Windows only.

Full details: CHANGELOG.md (0.4.1–0.4.5). Source archive for the boot drive's GPL iPXE is attached by the release workflow as before.