installer: add evict payload, pre-saved token config, fix delay

- Restore evict.elf to PKG (staged assets: daemon.elf + evict.elf + config.json)
- step_files copies both evict.elf and orbisrpc.bin to /data/GoldHEN/bin/elf/
- Pre-save config.json with Discord token so step_token() skips entry
- Move sceSystemServiceHideSplashScreen() to top of main() — eliminates
  visible delay between splash hide and first dialog (ui_init() now
  runs with splash already gone)
- Add installer/assets/config.json as PKG asset
- Explicitly list evict.elf and config.json in create-gp4 --files
- Update INSTALLER.md to reflect evict flow and no-sleep fact

Verified: PKG has all 3 assets, EBOOT matches, SHA-256 match, tests green

docs/INSTALLER.md

@@ -3,10 +3,9 @@
 ## What it does
 
 One linear flow, forward-only (every No skips ahead, nothing loops back):
-confirm → copy `orbisrpc.bin` to `/data/GoldHEN/bin/elf/` (mkdir -p +
-byte-count + hash read-back, one OK/denied line) → token prompt (skipped
-when valid) → done. Declining install offers a read-only status screen
-instead.
+confirm → copy `evict.elf` + `orbisrpc.bin` to `/data/GoldHEN/bin/elf/`
+(mkdir -p + byte-count + FNV hash read-back) → pre-saved config with token
+(skips entry when valid) → done. Read-only status screen available via decline.
 
 There is no WiFi check. The installer runs sandboxed, so its socket probe
 measures the app's network stack, not the payload's — and a FAILED line
@@ -14,8 +13,22 @@ reads like a verdict on Discord itself. The daemon reports real reachability
 in its own log once started.
 
 The installer never boots anything. Starting the daemon is GoldHEN's
-payload menu or AutoRun — see below. No loopback ports, no eviction, no
-boot proof to go wrong.
+payload menu — pick `evict.elf` first (removes old orbisrpc instance),
+then pick `orbisrpc.bin`. No loopback ports, no injection, no boot proof
+to go wrong.
+
+## Install flow
+
+```
+confirm → copy evict.elf to /data/GoldHEN/bin/elf/evict.elf
+        → copy orbisrpc.bin to /data/GoldHEN/bin/elf/orbisrpc.bin
+        → save config.json with Discord token
+        → (token entry skipped if already valid)
+        → done
+```
+
+The user then launches `evict.elf` first from GoldHEN's payload menu
+(to evict any running orbisrpc), then launches `orbisrpc.bin`.
 
 ## Navigation law
 
@@ -28,10 +41,12 @@ button on No, which inverts the whole wizard.
 
 ## Console facts encoded
 
-- Splash must hide before dialogs (`sceSystemServiceHideSplashScreen`) +
-  3 s foreground settle, or the first dialog flash-dismisses.
-- Dialog/IME/IME-backend sysmodules + internal SYSTEM/USER/COMMON modules
-  load before use (unloaded calls panic).
+- Splash is hidden first thing in `main()` so module loading in
+  `ui_init()` happens with the splash already gone — no visible delay
+  between splash hide and first dialog.
+- Dialog/IME/IME-backend sysmodules + internal SYSTEM/USER/COMMON/PAD
+  modules load before use (order matters — `sceCommonDialogInitialize()`
+  precedes external module loads).
 - `stat()`/`fstat()` lie about sizes inside the sandbox (observed 4096/4160
   for a 2071552-byte file), so install proof is byte count + FNV hash on
   read-back, and status uses open-existence, never stat.
@@ -48,5 +63,6 @@ installer shows where, it can't write the queue itself.
 ## Building
 
 `make -f installer/Makefile` (`OO_PS4_TOOLCHAIN`, llvmshim). Staged assets:
-daemon + evict ELFs — the installer only reads the daemon, evict rides along
-for manual injection. Output: `IV0000-ORPC00001_00-ORBISRPCSETUP000.pkg`.
+`daemon.elf`, `evict.elf`, `config.json`. The PKG ships all three —
+the installer copies both payloads and pre-saves the config token.
+Output: `IV0000-ORPC00001_00-ORBISRPCSETUP000.pkg`.