fix(steamdeck): install the plugin runner + harden Deck pad typing + repair update.sh

- scripts/steamdeck/install.sh (§2b) + update.sh: build and install the
  scripting runner user-scoped (~/.local wrapper + pinned bun + bundle) —
  SteamOS's read-only /usr can't take the .deb layout, so the console's
  plugin store reported "the plugin runner isn't installed" on every
  SteamOS host. update.sh retrofits it onto existing installs.
- plugins.rs runner discovery: check the ~/.local layout after the /usr
  ones; mention the SteamOS path in the not-installed error.
- update.sh: define warn() — it was used but never defined, so under
  `set -e` the first warn aborted the update before services restarted.
- pf-client-core gamepad: a Steam Input virtual pad forwarded on a real
  Deck (the only-pad case) now declares the DECK kind in its per-pad
  arrival instead of the wrapper's Xbox 360 identity — the session-level
  auto_pref already resolved SteamDeck, but the arrival overrides it on
  current hosts.
- reject tests: cover SetupFailed; move the foreign-code probe off 0x68.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/steamdeck/install.sh

@@ -153,6 +153,35 @@ cd '$SRC/web' && bun install --frozen-lockfile && bun run build
     ok "web console built"
 fi
 
+# --- 2b. plugin runner (scripting) -----------------------------------------
+# The console's plugin store and `punktfunk-host plugins …` shell out to the scripting runner —
+# the SDK's runner CLI bundled to one self-contained JS, run on a pinned bun (it import()s the
+# operator's .ts plugins; see packaging/debian/build-scripting-deb.sh). The .deb lays it out under
+# /usr, which is read-only here, so ship the SAME payload user-scoped — wrapper + private bun +
+# bundle under ~/.local, where the host's runner discovery looks after the /usr layouts.
+log "Building the plugin runner (scripting)"
+mkdir -p "$HOME/.local/bin" "$HOME/.local/lib/punktfunk-scripting" "$HOME/.local/share/punktfunk-scripting"
+distrobox enter "$BOX" -- bash -lc "
+set -e
+export PATH=\$HOME/.bun/bin:\$PATH
+cd '$SRC/sdk'
+bun install --frozen-lockfile --ignore-scripts
+bun build src/runner-cli.ts --target=bun --outfile \"\$HOME/.local/share/punktfunk-scripting/runner-cli.js\"
+# Pin the runtime: copy the box's bun next to the bundle so a bun self-update (or a box rebuild)
+# never changes what the runner executes under.
+install -m0755 \"\$(command -v bun)\" \"\$HOME/.local/lib/punktfunk-scripting/bun\"
+"
+grep -q 'attempt=' "$HOME/.local/share/punktfunk-scripting/runner-cli.js" \
+    || die "runner bundle missing the dynamic plugin import — wrong build"
+cat > "$HOME/.local/bin/punktfunk-scripting" <<'WRAP'
+#!/bin/sh
+# Generated by scripts/steamdeck/install.sh — user-scoped punktfunk-scripting (the .deb's /usr/bin
+# wrapper, relocated): the runner bundle on its private pinned bun.
+exec "$HOME/.local/lib/punktfunk-scripting/bun" "$HOME/.local/share/punktfunk-scripting/runner-cli.js" "$@"
+WRAP
+chmod 0755 "$HOME/.local/bin/punktfunk-scripting"
+ok "plugin runner: ~/.local/bin/punktfunk-scripting"
+
 # --- 3. config -------------------------------------------------------------
 log "Configuration ($CONFIG)"
 mkdir -p "$CONFIG"
@@ -306,6 +335,13 @@ EOF
     ok "punktfunk-web.service (port $WEB_PORT)"
 fi
 
+# The runner's user unit (OPT-IN, matching the .deb: installed but NOT enabled — the runner is
+# inert until you add scripts/plugins). ExecStart is rewritten from the packaged /usr wrapper to
+# the user-scoped one section 2b installed.
+sed 's|^ExecStart=.*|ExecStart=%h/.local/bin/punktfunk-scripting|' \
+    "$SRC/scripts/punktfunk-scripting.service" > "$UNITS/punktfunk-scripting.service"
+ok "punktfunk-scripting.service (opt-in: systemctl --user enable --now punktfunk-scripting)"
+
 systemctl --user daemon-reload
 loginctl show-user "$USER" 2>/dev/null | grep -q 'Linger=yes' || { sudo loginctl enable-linger "$USER" 2>/dev/null && ok "enabled linger (services run without login)" || warn "could not enable linger — services stop when you log out (sudo loginctl enable-linger $USER)"; }
 # enable + restart (not `enable --now`): restart picks up unit-file changes on a re-run, where