TV shell (`apps/tv/`): one long-running Craft process booted directly by init — home screen (hero/top shelf, app row, Continue Watching, Recently Added), app lifecycle, global state, crash recovery

Epic: #113 · Milestone: MC7 — TV shell

Why

The product. HomeOS boots into this instead of a desktop: init launches apps/tv/tv (an ELF built from Home — the first real .home userspace binary; userland/ only has assembly today), which owns the display, input, audio and the library, and hosts the built-in "apps" (Movies, TV, Music, Photos, Settings) as screens in one process (MASTER_PLAN §9's one-process shell architecture; lowest memory floor).

Tasks

• Userspace foundation: libs/libc subset + apps/lib/syscalls.home exercised for real (files, mmap of the framebuffer/DMA buffers via a display syscall, sockets, threads, timers, input event device). Track which syscalls the shell needs → Phase 3 backlog.
• init (apps/init/) for the TV profile: mount filesystems, start network, start the shell, respawn on crash with a crash screen + serial dump, watchdog feed.
• Home screen from .stx: hero/top shelf (backdrop + summary of the focused item), rows: Continue Watching, Recently Added Movies/Episodes, Music, Photos, Sources, Settings; artwork tiles with lazy decode (#78).
• Global UI: header clock/network/status icons, toast notifications, modal dialogs, loading skeletons, empty states, error screens.
• State: settings store (TOML/JSON on disk via bunfig-style schema ported to Home), library DB client (#102), background job scheduler (scan, thumbnails, metadata).
• Boot sequence tuned for the boot-to-home-screen budget: splash frame at < 1 s, home screen skeleton at < 4 s, artwork streamed in.

Acceptance

QEMU x86: the shell boots from init, shows the home screen from generated Home code, navigates rows with the keyboard; Pi: same via HDMI + CEC; idle-budget measured.

Size: XL · Depends on: #89, #91, #75, #76, #65 · Blocks: #93, #95, #94