feat(host): GameStream opt-in on every route; the native plane is deny(unsafe_code)-enforced

The user direction after WP0: ENet exists only for Moonlight, so the native
plane must be provably safe and the compat planes a deliberate choice.

Opt-in, everywhere. Windows already was (unchecked installer task). The three
opt-out surfaces are flipped: the shipped systemd user unit (deb/RPM/Arch/
sysext) no longer bakes --gamestream into ExecStart — a new
PUNKTFUNK_GAMESTREAM=1 host.env knob (pf-host-config, OR-ed with the CLI
flag) is the packaged opt-in; the NixOS module default goes true→false, with
a module-check assertion that unset = native-only; the Deck installer takes
--gamestream to opt in (--no-gamestream kept as explicit-off). Docs
(quickstart, running-as-a-service, moonlight, ubuntu/fedora/arch firewall
sections, gnome/sway, how-it-works) rewritten to the opt-in shape; the
CHANGELOG carries the upgrade note.

Enforced-safe. punktfunk-core is #![deny(unsafe_code)] crate-wide — every
module that parses network bytes is safe Rust as a compile error, not a
census result. Carve-outs are exactly two documented classes, neither of
which interprets attacker bytes: the client surface (abi, client) and the
transport syscall-batching shims (udp/{apple,linux,windows}, qos_windows).
In punktfunk-host, the modules a secure-default host exposes — native
(cfg-not-test: its tests exercise the client C ABI on purpose),
native_pairing, mgmt, mgmt_token, discovery, wol — are #[forbid(unsafe_code)].

Gates: Linux amd64 container clippy --all-targets -D warnings clean over
core+host-config+host; core 204 tests green under the deny; mgmt 46/46,
control 6/6. .133 Windows clippy (shipped features, clean-first,
sentinel-checked) clean — covers the qos_windows/udp-windows carve-outs.
macOS + iOS cargo check green (the apple.rs carve-out compiles for real).

scripts/host.env.example

@@ -14,6 +14,13 @@
 #     Mode mid-stream then kills the stream instead of being followed), and stale session vars
 #     point detection at dead sockets. Those knobs are for CI and dedicated appliances (below).
 
+# GameStream/Moonlight compatibility — OPT-IN (the shipped unit runs the secure native-only
+# host). Set =1 so stock Moonlight clients can pair and stream; TRUSTED LANs only — the compat
+# planes carry plain-HTTP pairing + the legacy GCM-nonce path (security-review #5/#9), and need
+# their extra firewall ports (TCP 47984/47989/48010, UDP 47998-48000/48002/48010; the packages
+# ship a `punktfunk-gamestream` firewalld service / ufw profile for exactly this).
+#PUNKTFUNK_GAMESTREAM=1
+
 # Video source (GameStream/Moonlight sessions only): `virtual` creates a per-client virtual
 # output at the client's exact resolution+refresh (the flagship mode, and the default);
 # `portal` captures an existing monitor.