fix(host/windows): HDR cursor brightness (203-nit) + probe-before-adopt recovery; windows-client bootstrap doc

- HDR cursor: sRGB→linear decode + scale to HDR graphics white (PUNKTFUNK_HDR_CURSOR_NITS, default
  203 per BT.2408) in the FP16 cursor composite, so it's no longer ~2.5x too dim. SDR path unchanged;
  the masked-color (I-beam) inversion blend left unscaled. Cursor cbuffer widened 16→32 + bound to PS.
  (Validated live: cursor now correct brightness in HDR.)
- Secure-desktop recovery: recreate_dupl now PROBES the rebuilt duplication with a 50ms
  AcquireNextFrame and only adopts it when live (Ok/WAIT_TIMEOUT); a born-lost one (immediate
  ACCESS_LOST) is dropped so the caller repeats the last frame + retries. Plus reassert_isolation()
  re-detaches physical displays on every recovery (re-routing the secure/HDR desktop to the virtual
  output, the delta a fresh reconnect has). NOTE: the born-lost ACCESS_LOST storm in HDR is NOT yet
  resolved by these — still under investigation (animations/secure-UI/cursor-trail in HDR remain).
- docs/windows-client-bootstrap.md: handoff for the native Windows Rust client (windows-rs Reactor +
  WinUI 3 SwapChainPanel, D3D11VA decode, WASAPI audio, SDL3 input; ports crates/punktfunk-client-linux;
  10-bit/HDR present; dev boxes + gotchas).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/vdisplay/sudovda.rs

@@ -347,6 +347,20 @@ unsafe fn restore_displays(saved: &[(String, DEVMODEW)]) {
     }
 }
 
+/// Re-detach physical displays so the secure (Winlogon) desktop keeps rendering to the virtual
+/// output — for the in-session DXGI capture recovery (dxgi.rs `recreate_dupl`). The lock/UAC/login
+/// switch can re-attach a physical monitor (the secure desktop then lands on IT and our virtual
+/// output goes perpetually ACCESS_LOST — the "born-lost" storm); re-running the isolate routes the
+/// secure desktop back to the virtual output, mirroring what a fresh session's `create` does (the
+/// delta that makes a reconnect work where in-session recovery didn't). Idempotent + cheap: when
+/// nothing besides `gdi_name` is attached, [`isolate_displays`] finds nothing to detach and commits
+/// nothing — so this is safe to call on every throttled recovery tick (no display thrash).
+pub(crate) fn reassert_isolation(gdi_name: &str) {
+    unsafe {
+        let _ = isolate_displays(gdi_name);
+    }
+}
+
 unsafe fn open_device() -> Result<HANDLE> {
     let hdev = SetupDiGetClassDevsW(
         Some(&SUVDA_INTERFACE),