feat(gamepad): controller discovery + client-negotiated pad type + rich DualSense end to end

The Apple client grows full gamepad support and punktfunk/1 learns to negotiate
the virtual pad type:

- Protocol: Hello carries a GamepadPref byte (offset 21, the same trailing-byte
  back-compat pattern as the compositor; echoed resolved in Welcome at 54).
  Host precedence: explicit client choice > PUNKTFUNK_GAMEPAD env > Xbox 360,
  DualSense (UHID) only where available. ABI: punktfunk_connect_ex2 +
  punktfunk_connection_gamepad (connect_ex delegates; ABI_VERSION stays 2 — the
  trailing byte IS the compat mechanism). punktfunk-client-rs gets --gamepad.

- Swift client: GamepadManager (app-lifetime discovery + selection — Settings
  lists every controller with capabilities/battery/"In use"; exactly ONE pad
  forwards as pad 0, auto = most recently connected, or pinned), GamepadCapture
  (snapshot-diff button/axis events, DualSense touchpad + ~250 Hz motion on the
  rich-input plane, held state released on switch/deactivate/stop),
  GamepadFeedback (rumble → CoreHaptics per-handle engines; lightbar →
  GCDeviceLight; player LEDs → playerIndex; adaptive-trigger blocks → the
  table-driven DualSenseTriggerEffect parser → GCDualSenseAdaptiveTrigger,
  exact for the 10-zone positional modes). The pad type auto-resolves from the
  physical controller at connect time, user-overridable in Settings.

- Host DualSense fixes surfaced by adversarial review against hid-playstation /
  SDL / Nielk1 ground truth: input-report sensor/touch offsets were off by one
  (the kernel read garbage motion + phantom touches), the L2/R2 trigger blocks
  were swapped (the report is right-trigger-first), feedback now gates on the
  report's valid-flags (a plain rumble write no longer blanks lightbar/
  triggers), and the touchpad rescale clamps to the advertised ABS_MT extents.

- Tests: Hello/Welcome trailing-byte back-compat, pick_gamepad precedence,
  byte-exact input-report layout, valid-flag gating, per-mode trigger-parser
  table (incl. packed 3-bit zones), wire conversions, and a scripted loopback
  feedback burst (PUNKTFUNK_TEST_FEEDBACK=1) asserted through the xcframework
  on the rumble + HID-output planes.

Validated: cargo test/clippy/fmt green on macOS + Linux (61 host tests), swift
build/test green, test-loopback.sh green, tvOS/iOS targets compile. DualSense
motion sign/scale is derived from the calibration blob, not yet live-verified
(constants isolated in GamepadWire).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-client-rs/src/main.rs

@@ -27,10 +27,16 @@
 //! `gamescope`); the host honors it if available, else auto-detects and reports the resolved
 //! choice in its Welcome (logged as `session offer … compositor=…`).
 //!
+//! `--gamepad NAME` requests a host virtual-pad backend (`auto`|`xbox360`|`dualsense`); the
+//! host honors it where available (DualSense needs Linux UHID), else falls back to X-Box 360,
+//! and reports the resolved choice in its Welcome (logged as `session offer … gamepad=…`).
+//!
 //! Usage: `punktfunk-client-rs [--connect HOST:PORT] [--mode WxHxFPS] [--out FILE] [--input-test]
-//!         [--pin HEX] [--compositor NAME]` (M4 adds VAAPI decode + wgpu present on this skeleton.)
+//!         [--pin HEX] [--compositor NAME] [--gamepad NAME]`
+//! (M4 adds VAAPI decode + wgpu present on this skeleton.)
 
 use anyhow::{anyhow, Context, Result};
+use punktfunk_core::config::GamepadPref;
 use punktfunk_core::config::Role;
 use punktfunk_core::input::{InputEvent, InputKind};
 use punktfunk_core::quic::{endpoint, io, Hello, Reconfigure, Reconfigured, Start, Welcome};
@@ -59,6 +65,8 @@ struct Args {
     name: String,
     /// `--compositor NAME` — request a host compositor backend (auto|kwin|wlroots|mutter|gamescope).
     compositor: CompositorPref,
+    /// `--gamepad NAME` — request a host virtual-pad backend (auto|xbox360|dualsense).
+    gamepad: GamepadPref,
 }
 
 fn parse_mode(m: &str) -> Option<Mode> {
@@ -145,6 +153,17 @@ fn parse_args() -> Args {
             }
         },
     };
+    // Same fail-closed discipline for --gamepad.
+    let gamepad = match get("--gamepad") {
+        None => GamepadPref::Auto,
+        Some(s) => match GamepadPref::from_name(s) {
+            Some(g) => g,
+            None => {
+                eprintln!("--gamepad must be one of: auto, xbox360, dualsense");
+                std::process::exit(2);
+            }
+        },
+    };
     Args {
         connect: get("--connect").unwrap_or("127.0.0.1:9777").to_string(),
         mode,
@@ -158,6 +177,7 @@ fn parse_args() -> Args {
         pair: get("--pair").map(String::from),
         name: get("--name").unwrap_or("punktfunk-client-rs").to_string(),
         compositor,
+        gamepad,
     }
 }
 
@@ -242,6 +262,7 @@ async fn session(args: Args) -> Result<()> {
             abi_version: punktfunk_core::ABI_VERSION,
             mode: args.mode,
             compositor: args.compositor,
+            gamepad: args.gamepad,
         }
         .encode(),
     )
@@ -254,6 +275,7 @@ async fn session(args: Args) -> Result<()> {
         encrypt = welcome.encrypt,
         frames = welcome.frames,
         compositor = welcome.compositor.as_str(),
+        gamepad = welcome.gamepad.as_str(),
         "session offer"
     );