Turn the ambient panel float off by default

Bisected against the user's report that the button used to work. Same
save test, run repeatedly:

c9d9189 "motion runtime + icons 1.0" save works 3/3
48fd5c7 "UI: 3D depth layer ..." save FAILS 0/4
float off (this commit) save works 4/4

The regression entered with the 3D depth layer. Its ambient float never
settles, and a surface that never settles carries its buttons out from
under the pointer -- a click fires only when mousedown and mouseup land
on the same element, so the press registers and nothing happens, which
is exactly how it was reported.

Freezing the float near the pointer fixes this in principle and in every
automated test here, but it did not hold in the user's hands across
three attempts, so the working button wins over the effect. The
proximity-freeze machinery is kept intact behind the flag.

UPS_PANEL_FLOAT=1 restores the drift. Only that one effect is gated:
aurora, motes, entrances, sheen, press, hover lift, card tilt, ring
draw and counters all still run (verified: 6 live web animations and 5
CSS animations after the change, 0 perpetual floats).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/ui/motion_runtime.py

@@ -69,6 +69,22 @@ _DRIVER = r"""
   var M = window.Motion;
   if (!M || !M.animate) return;
 
+  // The ambient panel float — the perpetual translateZ/rotate loop added in
+  // "UI: 3D depth layer" — is OFF unless UPS_PANEL_FLOAT is set.
+  //
+  // It is the one effect that never settles, and a surface that never settles
+  // drags its buttons out from under the pointer: a click fires only when
+  // mousedown and mouseup land on the same element. Measured against that
+  // commit, Save Configuration failed to save on 4 of 4 attempts; on the
+  // commit before it, and with the float off, it saves every time.
+  //
+  // Freezing it near the pointer (below) fixes this in principle and in every
+  // automated test, but not reliably in the hand, so the working button wins
+  // over the effect. Set UPS_PANEL_FLOAT=1 to bring the drift back — the
+  // proximity-freeze machinery below stays in place for that case.
+  var FLOAT_ON = false;
+  try { FLOAT_ON = !!window.__upsPanelFloat; } catch (e) {}
+
   var EASE = [0.22, 0.61, 0.36, 1];
   var SPRING = { type: 'spring', stiffness: 320, damping: 30, mass: 0.9 };
   var reduce = false;
@@ -140,6 +156,11 @@ _DRIVER = r"""
   // long as the node lives, so nothing else may clear it. Anything that wants
   // the transform (hover, press, tilt) pauses this first and resumes after.
   function float3d(el, i) {
+    // OFF by default — see FLOAT_ON. This is the single choke point for the
+    // perpetual drift, so gating here leaves every other piece of the motion
+    // layer (entrances, press, hover lift, tilt on presentation cards, sheen,
+    // ring draw, counters) running exactly as designed.
+    if (!FLOAT_ON) return;
     if (!canMove(el)) return;
     depthParent(el);
     el.style.transformStyle = 'preserve-3d';
@@ -570,6 +591,11 @@ def inject() -> None:
     reduce_motion = (os.getenv("UPS_REDUCE_MOTION", "") or "").strip().lower() in (
         "1", "true", "yes", "on"
     )
+    # Opt-in for the perpetual panel drift. Off by default because it moves
+    # buttons out from under a click; see FLOAT_ON in the driver.
+    panel_float = (os.getenv("UPS_PANEL_FLOAT", "") or "").strip().lower() in (
+        "1", "true", "yes", "on"
+    )
     components.html(
         # The payloads come first: the bootstrap below reads them by id, and a
         # <script> only sees the document that exists above it.
@@ -586,6 +612,7 @@ def inject() -> None:
         "      var w = window.parent, d = w.document;\n"
         "      if (!d || !d.head) return false;\n"
         "      w.__upsReduceMotion = " + ("true" if reduce_motion else "false") + ";\n"
+        "      w.__upsPanelFloat = " + ("true" if panel_float else "false") + ";\n"
         "      if (!w.Motion) {\n"
         "        var s = d.createElement('script');\n"
         "        s.id = 'ups-motion-lib';\n"