refactor: rename pf-vdisplay-proto -> pf-driver-proto (it spans all drivers)

The shared host<->driver ABI crate already contains more than the virtual
display: the IDD-push frame ring + control plane AND the gamepad shared-memory
layouts (XusbShm / PadShm). "pf-vdisplay-proto" was a misnomer — the name now
represents all the drivers it serves.

Mechanical rename, no behavior change:
- git mv crates/pf-vdisplay-proto -> crates/pf-driver-proto (package name +
  path-deps in the host crate and the driver workspace).
- pf_vdisplay_proto -> pf_driver_proto across host + driver Rust, both Cargo.lock
  files, the workspace members, the CI path triggers (windows-drivers.yml), and
  the docs/INF comments. The runtime Global\pfvd-* shared-object names are a
  SEPARATE contract and are deliberately untouched (host<->driver name matching).
- The pf-vdisplay DRIVER crate + its INF service name (Root\pf_vdisplay,
  UmdfService=pf_vdisplay, pf_vdisplay.dll) are unchanged — only the full
  `pf_vdisplay_proto` token was replaced, never the `pf_vdisplay` driver name.

Linux-verified: cargo test -p pf-driver-proto (const size-asserts compile) +
cargo clippy -p punktfunk-host -D warnings clean; Cargo.lock regenerated. The
driver-workspace side (path-dep + imports + its Cargo.lock) is Windows-CI-gated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/windows-host-rewrite.md

@@ -8,7 +8,7 @@
 > This file **consolidates and replaces** five earlier docs (now retired into it): the rewrite design
 > plan, the Goal-1 staged-refactor plan, the audit, the audit-remediation tracker, and the
 > fullscreen-game capture-bug analysis. See the [consolidation note](#appendix--consolidation-note) for
-> what moved where. **Last updated 2026-06-25.** Work lives on branch **`windows-host-goal1`** (off
+> what moved where. **Last updated 2026-06-26.** Work lives on branch **`windows-host-goal1`** (off
 > `main`, not yet merged).
 
 ---
@@ -35,7 +35,7 @@ which kept the live-validated host working at every step. The driver, by contras
 | **Goal 1** — clean, layered host architecture | ✅ **DONE** | `config.rs` (`HostConfig`), `session_plan.rs` (`SessionPlan`), `SessionContext`, `windows/`+`linux/` confinement (`38c68c3`), `VirtualDisplayManager` (§2.5), `EncoderCaps` (`0ccd0fe`) |
 | **Goal 2** — drop every trace of SudoVDA | ✅ **DONE** | reach-in decoupled (F1: `d638a93`/`e60cda3` → `win_adapter`/`win_display`), then the `sudovda.rs` backend + the dual-backend select **deleted** (this branch) — pf-vdisplay is the sole Windows virtual-display backend |
 | **Goal 3** — minimize `unsafe` + P0 lints | 🟡 **PARTIAL** | driver `deny(unsafe_op_in_unsafe_fn)` (`a755d6e`); host crate has **no** P0 lints yet; `OwnedHandle` adopted in `manager.rs`/`pf_vdisplay.rs`/`sudovda.rs`, **not** `idd_push.rs` |
-| **M0** — proto ABI + driver toolchain + `/INTEGRITYCHECK` + `iddcx` | ✅ **DONE** | `pf-vdisplay-proto`; vendored `windows-drivers-rs` 0.5.1; `clear-force-integrity.ps1`; CI-green |
+| **M0** — proto ABI + driver toolchain + `/INTEGRITYCHECK` + `iddcx` | ✅ **DONE** | `pf-driver-proto`; vendored `windows-drivers-rs` 0.5.1; `clear-force-integrity.ps1`; CI-green |
 | **M1** — new IddCx driver, first light + HDR | ✅ **DONE (on-glass)** | STEP 0–8 (`d7a9fbf`…`cd59151`); HDR live ("Mac connects WITH HDR", `6399d28`) |
 | **M2** — IDD-push capture + NVENC, glass-to-glass | ✅ **DONE (on-glass)** | 5120×1440@240 HDR zero-copy; integrated into the host path |
 | **M3** — service / input / audio / **secure desktop** | ✅ **DONE (on-glass)** | secure desktop (lock/UAC) **owner-confirmed 2026-06-25** — IDD-push captures it + input reaches it |
@@ -57,7 +57,7 @@ which kept the live-validated host working at every step. The driver, by contras
   and top-level `src/windows/`+`src/linux/`). Module names stay flat (`#[path]`), so caller paths are
   platform-agnostic.
 - **`crates/punktfunk-core`** — the one linked protocol/FEC/crypto/QUIC core (unchanged here).
-- **`crates/pf-vdisplay-proto`** — the owned, `no_std` host↔driver ABI (frame ring + control plane +
+- **`crates/pf-driver-proto`** — the owned, `no_std` host↔driver ABI (frame ring + control plane +
   gamepad SHM), consumed by both the host crate and the driver workspace (§2.7).
 - **`packaging/windows/drivers/`** — the unified driver workspace on `microsoft/windows-drivers-rs`
   (vendored 0.5.1 + an `iddcx` subset): members `pf-vdisplay` (the IddCx display driver), `wdk-iddcx`
@@ -139,7 +139,7 @@ HEVC Main10 + BT.2020 PQ; the client auto-detects PQ from the VUI. The encoder a
 size/format/HDR change per frame (tears down + re-inits), so the GB1 capturer's resolution changes are
 handled downstream with no API change.
 
-### 2.7 Host↔driver ABI — `pf-vdisplay-proto`
+### 2.7 Host↔driver ABI — `pf-driver-proto`
 
 One `no_std` crate, both build graphs. Owns the **frame plane** (`SharedHeader`, `FrameToken { generation,
 seq, slot }` with `pack`/`unpack`, `Global\pfvd-*` name helpers), the **control plane** (fresh interface
@@ -155,7 +155,7 @@ All-Rust UMDF IddCx driver on `windows-drivers-rs` + the `iddcx` `wdk-sys` subse
 (`packaging/windows/drivers/pf-vdisplay/src/`): `entry.rs` (DriverEntry + `IDD_CX_CLIENT_CONFIG`, 15
 callbacks), `adapter.rs` (caps + FP16 + `SET_RENDER_ADAPTER`), `monitor.rs`/`callbacks.rs` (the `*2` HDR
 mode DDIs, EDID verbatim), `swap_chain_processor.rs` (the worker, `SetDevice`-retry + top-of-loop
-`terminate`), `frame_transport.rs` (the `FramePublisher` on `pf_vdisplay_proto::frame`), `control.rs` (the
+`terminate`), `frame_transport.rs` (the `FramePublisher` on `pf_driver_proto::frame`), `control.rs` (the
 typed IOCTL dispatch + host-gone **watchdog** + mode bounds). Self-signed-loadable under Secure Boot
 (FORCE_INTEGRITY cleared post-link). **Known gaps:** ownership state is still partly process-global
 (`MONITOR_MODES`/`NEXT_ID`/`ADAPTER`/`DEVICE_POOL`) with `EvtCleanupCallback` on the **WDFDEVICE** (not
@@ -198,7 +198,7 @@ These are expensive empirical wins; keep them intact when touching the code:
   gamepads; the encode|send split + microburst pacing; `build_pipeline_with_retry` permanent-vs-transient
   classification; the GameStream `VideoPacketizer` (GF8 Cauchy, Moonlight byte-exact); the pairing/trust
   handshake.
-- **Core discipline:** no async on the per-frame path; `pf-vdisplay-proto` is the single ABI source
+- **Core discipline:** no async on the per-frame path; `pf-driver-proto` is the single ABI source
   (drift = compile error); the version handshake the host asserts.
 
 ---
@@ -254,7 +254,7 @@ actually needed.** (`monitor.rs` documents this rationale at the `MONITOR_MODES`
 9. **M4 — gamepad-driver unification.** Fold `pf_dualsense` + `pf_xusb` (standalone
    `packaging/windows/{dualsense,xusb}-driver/` on the old WDF stack) into the unified `drivers/` workspace
    on `windows-drivers-rs` with WDF device contexts (true multi-pad), and point the **driver side** at
-   `pf_vdisplay_proto::gamepad::{PadShm,XusbShm}` (host side already does — the `device_type`-at-offset-140
+   `pf_driver_proto::gamepad::{PadShm,XusbShm}` (host side already does — the `device_type`-at-offset-140
    hand-duplication is the last ABI-drift hazard). Largest item.
 10. **M5 — reshape WGC/DDA + GameStream onto `session/pipeline`**, then delete the old relay/monoliths.
     AMF/QSV stays CI-only (no lab hardware).
@@ -291,7 +291,7 @@ queue, so driver pushes that avoid `Cargo.toml` skip the fleet serialization.
 
 Local pre-push checks (this Linux box can't compile the Windows paths):
 ```sh
-cargo test  -p pf-vdisplay-proto                 # the ABI crate (cross-platform)
+cargo test  -p pf-driver-proto                 # the ABI crate (cross-platform)
 cargo check -p punktfunk-host                     # Linux paths; win_* mods are #[cfg(windows)]
 cargo clippy -p punktfunk-host --all-targets -- -D warnings
 # Windows host clippy (on the box): PUNKTFUNK_NVENC_LIB_DIR=C:\t\nvenc;
@@ -370,10 +370,10 @@ exactly correct.
    under Secure Boot, enumerates as an IddCx adapter, Status OK.)
 4. control plane (`GET_INFO` version handshake the host asserts, ADD/REMOVE/SET_RENDER_ADAPTER/PING/
    CLEAR_ALL) + create_monitor + real mode DDIs + watchdog + mode bounds; host switched to
-   `pf_vdisplay_proto`.
+   `pf_driver_proto`.
 5. `Direct3DDevice` + assign/unassign + `SwapChainProcessor` (worker, `SetDevice` 60×@50 ms single-borrow
    retry, top-of-loop `terminate`, `ReleaseAndAcquireBuffer2`, `from_raw_borrowed`).
-6. `FramePublisher` on `pf_vdisplay_proto::frame` + keyed-mutex RAII guard; wire into `run_core`. (Box:
+6. `FramePublisher` on `pf_driver_proto::frame` + keyed-mutex RAII guard; wire into `run_core`. (Box:
    full IDD-push glass-to-glass + the **secure-desktop** gate — validated 2026-06-25.)
 7. HDR / FP16 ring (validated: Mac connects WITH HDR).
 8. its own `.inx` + an `unsafe`-reduction pass (`deny(unsafe_op_in_unsafe_fn)`, per-site `// SAFETY:`).