fix(video): honor the signaled CSC matrix end-to-end + tvOS HDR presentation

Clients derive Y'CbCr->RGB from the stream's SIGNALED matrix x range x depth
via shared csc rows (Rust csc_rows + Swift CscRows) instead of hardcoded
709/2020 - a BT.601-signaled stream (a Linux host's RGB-input NVENC) no longer
renders with a constant hue error. Host-side signaling made honest across
NVENC/VAAPI/openh264/GameStream and the session plan's chroma/bit-depth.
Decoded color-bar fixtures (601/709 x limited/full) pin the math in tests on
both cores.

Same presenter, tvOS HDR: tvOS has no Metal EDR API and a bare PQ colorspace
tag composites UNTONE-MAPPED (the "overblown" Apple TV report), so HDR now
splits on the display's live EDR headroom - PQ passthrough when the
per-session AVDisplayManager mode switch landed (a real HDR10 output
tone-maps itself), else an in-shader PQ->SDR tone-map (203-nit reference
white, extended-Reinhard 1000-nit knee, 2020->709) into the proven SDR layer
config. The 10-bit stream keeps its full decode depth either way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/punktfunk1.rs

@@ -979,6 +979,19 @@ async fn serve_session(
             "encode chroma"
         );
 
+        // Linux 4:4:4 rides the CPU swscale → 8-bit `YUV444P` path (see `encode/linux`) — there
+        // is no 10-bit 4:4:4 input there, so a 10-bit-negotiated session would silently encode
+        // 8-bit. Resolve the depth DOWN before the Welcome so the wire never overstates what the
+        // stream carries. (Windows NVENC composes Main 4:4:4 10 from an RGB input, so it keeps
+        // the resolved depth — this clamp is Linux-only.)
+        #[cfg(target_os = "linux")]
+        let bit_depth: u8 = if chroma.is_444() && bit_depth == 10 {
+            tracing::info!("4:4:4 on the Linux path encodes 8-bit YUV444P — resolving bit depth 8");
+            8
+        } else {
+            bit_depth
+        };
+
         // Reserve the data-plane UDP socket up front and HOLD it through streaming (no
         // bind→read→drop→rebind window a concurrent session could race for a fixed port). A fixed
         // `--data-port` yields `direct = true` (stream straight to the client's reported address,