docs(nix): bring the Nix docs in line with the module, and fix a stale claim they shared

There are three places Nix is documented — the public docs-site, packaging/nix/
README.md, and packaging/README.md — plus the changelog. All had drifted.

STALE CLAIM, and not only for Nix. install.md said the plugin runner's "user unit
ships **disabled** — enable it once you have" something to run. That is true only
of Arch and source installs: the deb postinst and RPM %post both
`systemctl --global enable punktfunk-scripting.service`, and the Bazzite sysext
bakes in a default.target.wants symlink (build-sysext.sh:113). bazzite.md carried
the same claim about its own image. Both corrected, per channel, with the reason
the default flipped — the library scanners are plugins, so a host without the
runner can come up with an empty library — and the `mask`-not-`disable` opt-out
the sysext's own comment documents.

docs-site:
  * install.md NixOS — `desktopSession` in the example and explained, the runner
    no longer needs enabling, and the host/console line says what autoStart does.
  * running-as-a-service.md — "Restart the host with your desktop" documented the
    drop-in for packaged installs only; NixOS gets its one-liner beside it.
  * bazzite.md — the runner is started for you, not "isn't started".

packaging/nix/README.md:
  * option tables gain `desktopSession`, `gamescopeHdr`, `gamescopePackage`, and
    the `punktfunk` group next to `input` (both are required — the udev rule
    chgrp's the vhci nodes and fails outright if the group was never created).
  * "what the module configures" gains the security.wrappers entry, and a note on
    why the capability sits on the encode worker and never on the host: a wrapper
    raises it into the ambient set, which lands it in the permitted set and fails
    KWin's /proc/<pid>/exe readlink identically to a file capability.
  * the appliance snippet no longer tells you to put pkgs.gamescope on PATH —
    gamescopeHdr does that with the patched build, and desktopSession is called
    out as the thing to leave off there.
  * a caveat recording that `nix flake check` does not check the module, and the
    two rules for editing module-check.nix (assertions stay pure Nix; assert
    list-valued unit fields on the lists, not the rendered text).

packaging/README.md: the flake ships five packages, not "host + client".

CHANGELOG.md v0.27.0: a NixOS section covering the comm/session-detection fix, the
module changes including the scripting default flip as an explicit behaviour
change, and the flake-check gap — plus the documentation bullets above.

docs-site/content/docs/bazzite.md

@@ -44,8 +44,10 @@ manifest is OpenPGP-signed by packages@unom.io (key `AF245C506F4E4763`, the same
 RPMs), and `punktfunk-sysext` checks that signature against a key baked into the script before it
 trusts a single checksum — so it needs `gpg` on the box, and it refuses a feed it can't verify.
 
-The plugin runner rides along in the image but isn't started: run
-`systemctl --user enable --now punktfunk-scripting` when you want [plugins](/docs/plugins).
+The plugin runner rides along in the image and is **started for you** — the image bakes in its
+`default.target.wants` symlink, because the game-library scanners ship as
+[plugins](/docs/plugins). To turn it off: `systemctl --user mask punktfunk-scripting` (`mask`, not
+`disable` — a plain disable cannot remove a symlink that lives in `/usr`).
 
 From then on:
 

docs-site/content/docs/install.md

@@ -101,6 +101,7 @@ services.punktfunk.host = {
   enable = true;
   users = [ "alice" ];     # added to the `input` group, for virtual gamepads
   openFirewall = true;
+  desktopSession = true;   # on a machine you log into — see below
   settings = { RUST_LOG = "info"; };   # these become host.env
 };
 ```
@@ -108,13 +109,27 @@ services.punktfunk.host = {
 The module does declaratively what the deb/RPM scriptlets do — the systemd user service, udev rules,
 kernel modules, sysctl tuning, the firewall ports and `input` group membership — and brings in the
 web console alongside the host. Because `settings` writes the environment file for you, skip the
-`host.env` step in [After installing](#after-installing). The user services are defined but not
-started, so from your graphical session enable the host and the console:
+`host.env` step in [After installing](#after-installing).
+
+**Set `desktopSession = true` on any machine somebody logs into.** It ties the host to
+`graphical-session.target`, so restarting Plasma or GNOME restarts the host with it. Without it the
+host keeps running against a compositor that no longer exists — still listening, still answering,
+and failing at capture on every session after that. Leave it off for the headless appliance route
+(a pinned compositor or a gamescope box), which may never reach that target. Same reasoning, and
+the same caveats for Sway and Hyprland, as [Restart the host with your
+desktop](/docs/running-as-a-service#restart-the-host-with-your-desktop).
+
+The host and console user services are defined but not started (set `autoStart = true` for an
+appliance), so from your graphical session enable them:
 
 ```sh
 systemctl --user enable --now punktfunk-host punktfunk-web
 ```
 
+The plugin runner needs no such step — like the deb and RPM, the module starts it for you, because
+the game-library scanners ship as plugins. Opt out with
+`services.punktfunk.scripting.autoStart = false;`.
+
 The full option reference (client, console and scripting options, GPU driver notes, headless
 appliance setup) is in
 [packaging/nix](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/nix/README.md). To
@@ -138,14 +153,20 @@ update, run `nix flake update punktfunk` in your flake directory, then `sudo nix
   For Gaming Mode, add the [Decky plugin](/docs/steam-deck) on top of it. Full client instructions
   for every device: [Install a Client](/docs/install-client).
 
-- **`punktfunk-scripting`** — the plugin/script runner. Install it if you want
-  [plugins](/docs/plugins) or [automation](/docs/automation). It's inert until you add something to
-  run, so its user unit ships **disabled** — enable it once you have:
+- **`punktfunk-scripting`** — the plugin/script runner, behind [plugins](/docs/plugins) and
+  [automation](/docs/automation). The game-library scanners ship as plugins, so a host without the
+  runner can come up with an empty library — which is why **apt, dnf, the Bazzite sysext and the
+  NixOS module all start it for you**. On **Arch** and source installs it is not started, so enable
+  it yourself:
 
   ```sh
   systemctl --user enable --now punktfunk-scripting
   ```
 
+  To opt out where it *is* on: `systemctl --user mask punktfunk-scripting` (`mask`, not `disable` —
+  a plain disable cannot remove a symlink that lives in `/etc` or `/usr`), or on NixOS
+  `services.punktfunk.scripting.autoStart = false;`.
+
 ## After installing
 
 These three steps are for the **Linux packages**. On Windows the installer does the equivalent for

docs-site/content/docs/running-as-a-service.md

@@ -108,6 +108,12 @@ the host running against a compositor that no longer exists. It keeps listening
 every session after that fails at capture, which is a confusing way to find out. The drop-in makes a
 compositor restart a host restart.
 
+On **NixOS** don't copy anything — the module has the option:
+
+```nix
+services.punktfunk.host.desktopSession = true;
+```
+
 Skip it on the headless/appliance route below (which has its own session unit), and on **Sway or
 Hyprland**, which don't hand their session to systemd: they never reach `graphical-session.target`, so
 the drop-in is harmless there but does nothing. To make the host come and go with the session on