v0.5.5: visible boot progress + panic-on-screen for real hardware

Real hardware has no serial console: a pre-shell panic was a silent
blank screen (the panic handler only wrote to serial, then cli;hlt).
v0.5.4's shadow change made this window reachable — if the fb-aware
page allocation or the heap fallback failed on hardware, the kernel
halted before the shell banner with zero screen output.

- gop::boot_marker(): every boot stage now draws straight to the
  framebuffer (row 0, white-on-black).  The last marker visible before
  a hang identifies where the kernel died.
- Panic handler: pre-shell panics now draw a white-on-red
  '*** PANIC *** <msg> at file:line' band via gop::dump_lines.
- init_shadow(): heap fallback is panic-proof (try_reserve_exact +
  resize instead of vec![0; words] which aborts on OOM); page-alloc
  result defensively re-checked against the fb region; any failure
  degrades to no-shadow mode with a visible warning band.
- Verified: full chain (rsboot -> kernel) boots with markers, shell
  banner renders, all 5 test suites pass.

1 files changed, 9 insertions, 2 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index 1a1470c..196565c 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -126,8 +126,15 @@ backbuffer from the fb-aware page allocator (it can no longer land on
 the framebuffer — the heap free list spans the fb hole, so a 1.9 MB
 shadow could alias the display and turn every scroll into an MMIO→MMIO
 memcpy) and converts the scroll's shadow memmove to per-word stores as
-a belt-and-suspenders measure.  A future major GUI overhaul (graphics
-windows beyond the text surface) would be the `a` bump (1.0.0).
+a belt-and-suspenders measure; 0.5.5 makes every boot stage visible on
+real hardware (no serial console): `gop::boot_marker` prints the boot
+progress straight to the framebuffer (the last marker before a hang
+identifies the death site) and pre-shell panics now draw a white-on-red
+`*** PANIC ***` band instead of a silent blank screen, and the shadow
+fallback allocation is panic-proof (try_reserve; a heap OOM degrades
+to no-shadow mode instead of halting).  A future major GUI overhaul
+(graphics windows beyond the text surface) would be the `a` bump
+(1.0.0).
 
 ## Project layout