installer: route kernel/initramfs to ESP for encrypted protected installs (Limine can't read LUKS)

configs/airootfs/root/configurator

@@ -389,6 +389,17 @@ run_partition_install() {
     encrypt_installation=false
   fi
 
+  if [[ "$encrypt_installation" == "true" && -n "$shared_esp" ]]; then
+    abort "Encrypted install on a shared Windows ESP is not yet supported. Please choose unencrypted, or use Full Install."
+  fi
+
+  local esp_mount_in_target
+  if [[ "$encrypt_installation" == "true" ]]; then
+    esp_mount_in_target=/boot
+  else
+    esp_mount_in_target=/efi
+  fi
+
   # Detect T2 Mac and set appropriate kernel
   if lspci -nn 2>/dev/null | grep -q "106b:180[12]"; then
     kernel_choice="linux-t2"
@@ -467,7 +478,7 @@ run_partition_install() {
     rmdir /mnt/btrfs-root
 
     mount -o noatime,compress=zstd,subvol=@ "$root_mapper" /mnt
-    mkdir -p /mnt/home /mnt/var/log /mnt/var/cache/pacman/pkg /mnt/efi
+    mkdir -p /mnt/home /mnt/var/log /mnt/var/cache/pacman/pkg /mnt"$esp_mount_in_target"
     mount -o noatime,compress=zstd,subvol=@home "$root_mapper" /mnt/home
     mount -o noatime,compress=zstd,subvol=@log  "$root_mapper" /mnt/var/log
     mount -o noatime,compress=zstd,subvol=@pkg  "$root_mapper" /mnt/var/cache/pacman/pkg
@@ -475,7 +486,7 @@ run_partition_install() {
     if [[ -z "$shared_esp" ]]; then
       mkfs.fat -F32 -n OMARCHY_EFI "$efi_dev"
     fi
-    mount "$efi_dev" /mnt/efi
+    mount "$efi_dev" /mnt"$esp_mount_in_target"
   fi
 
   clear
@@ -573,7 +584,7 @@ _EOF_
 
   cat >/root/protected_install.json <<JSON
 {
-  "esp_mount": "/efi",
+  "esp_mount": "$esp_mount_in_target",
   "esp_path": "/EFI/Omarchy",
   "luks_uuid": $luks_uuid_json,
   "root_device": "$root_partition_device",

configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py

@@ -509,15 +509,15 @@ interface_branding: Omarchy Bootloader
 
 /Omarchy Linux
     protocol: linux
-    path: uuid({btrfs_uuid}):/@/boot/vmlinuz-{kernel}
+    path: {kernel_path}
     cmdline: {cmdline}
-    module_path: uuid({btrfs_uuid}):/@/boot/initramfs-{kernel}.img
+    module_path: {initrd_path}
 
 /Omarchy Linux (fallback)
     protocol: linux
-    path: uuid({btrfs_uuid}):/@/boot/vmlinuz-{kernel}
+    path: {kernel_path}
     cmdline: {cmdline}
-    module_path: uuid({btrfs_uuid}):/@/boot/initramfs-{kernel}-fallback.img
+    module_path: {initrd_fb_path}
 """
 
 
@@ -553,10 +553,23 @@ def _install_limine(ctx: InstallContext, protected: dict) -> None:
     shutil.copy2(src, dst)
 
     btrfs_uuid = _blkid_uuid(_btrfs_root_device(protected))
+    kernel = protected["kernel"]
+    if protected["esp_mount"] == "/boot":
+        kernel_path = f"boot():/vmlinuz-{kernel}"
+        initrd_path = f"boot():/initramfs-{kernel}.img"
+        initrd_fb_path = f"boot():/initramfs-{kernel}-fallback.img"
+    elif protected["esp_mount"] == "/efi":
+        kernel_path = f"uuid({btrfs_uuid}):/@/boot/vmlinuz-{kernel}"
+        initrd_path = f"uuid({btrfs_uuid}):/@/boot/initramfs-{kernel}.img"
+        initrd_fb_path = f"uuid({btrfs_uuid}):/@/boot/initramfs-{kernel}-fallback.img"
+    else:
+        raise RuntimeError(f"unsupported ESP mountpoint: {protected['esp_mount']}")
+
     cmdline = _build_cmdline(protected, btrfs_uuid)
     conf = LIMINE_CONF_TEMPLATE.format(
-        btrfs_uuid=btrfs_uuid,
-        kernel=protected["kernel"],
+        kernel_path=kernel_path,
+        initrd_path=initrd_path,
+        initrd_fb_path=initrd_fb_path,
         cmdline=cmdline,
     )
     (omarchy_esp / "limine.conf").write_text(conf)
@@ -838,11 +851,18 @@ def validate_boot_protected(ctx: InstallContext) -> None:
         if protected["luks_uuid"] not in crypttab.read_text():
             raise RuntimeError(f"{crypttab} missing LUKS UUID {protected['luks_uuid']}")
 
-    vmlinuz = ctx.target / "boot" / f"vmlinuz-{kernel}"
+    if protected["esp_mount"] == "/boot":
+        kernel_dir = ctx.target / protected["esp_mount"].lstrip("/")
+    elif protected["esp_mount"] == "/efi":
+        kernel_dir = ctx.target / "boot"
+    else:
+        raise RuntimeError(f"unsupported ESP mountpoint: {protected['esp_mount']}")
+
+    vmlinuz = kernel_dir / f"vmlinuz-{kernel}"
     if not vmlinuz.exists():
         raise RuntimeError(f"{vmlinuz} missing")
 
-    initramfs = ctx.target / "boot" / f"initramfs-{kernel}.img"
+    initramfs = kernel_dir / f"initramfs-{kernel}.img"
     if not initramfs.exists():
         raise RuntimeError(f"{initramfs} missing")