feat(video): 4:4:4 defaults — the host allows it, the client chooses it

Capability now lives on the host, choice on the client. PUNKTFUNK_444 flips
to DEFAULT ON with an explicit-off grammar (0/false/off/no — the old
presence-only flag() would have read =0 as on); every existing gate still
applies (client advertisement, HEVC, full-chroma capture, encode probe,
Windows HDR-display downgrade), so an unset host merely stops refusing. The
Apple client's "Full chroma (4:4:4)" toggle flips to DEFAULT OFF: full chroma
is a per-session trade — a clear win for desktop/text, but at a fixed bitrate
game content spends those bits better at 4:2:0, and the encode/decode pixel
rate rises. Persisted user choices survive both flips.

Live-verified on the CachyOS VM: host with no env negotiates
chroma_format_idc=3 for a 4:4:4-advertising client; PUNKTFUNK_444=0 resolves
4:2:0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/punktfunk1.rs

@@ -933,13 +933,15 @@ async fn serve_session(
             "encode bit depth"
         );
 
-        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host opted in
-        // (PUNKTFUNK_444), the client advertised VIDEO_CAP_444, the session is single-process (the
-        // two-process WGC relay encodes 4:2:0 in v1), and the active GPU/driver actually supports a
-        // 4:4:4 encode (probed, cached). The native path always encodes HEVC. We resolve this BEFORE
-        // the Welcome so `chroma_format` reflects what we'll really emit — the honest-downgrade
-        // channel: if any gate fails the client is told 4:2:0 before it builds its decoder. The probe
-        // opens a tiny encoder; it runs only when both opt-ins are set and is cached after the first.
+        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host
+        // allows it (PUNKTFUNK_444, default ON; the CLIENT's 4:4:4 setting — default OFF — is the
+        // per-session policy switch behind VIDEO_CAP_444), the client advertised VIDEO_CAP_444,
+        // the session is single-process (the two-process WGC relay encodes 4:2:0 in v1), and the
+        // active GPU/driver actually supports a 4:4:4 encode (probed, cached). The native path
+        // always encodes HEVC. We resolve this BEFORE the Welcome so `chroma_format` reflects
+        // what we'll really emit — the honest-downgrade channel: if any gate fails the client is
+        // told 4:2:0 before it builds its decoder. The probe opens a tiny encoder; it runs only
+        // when the earlier gates pass and is cached after the first.
         let host_wants_444 = crate::config::config().four_four_four;
         let client_supports_444 = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_444 != 0;
         // The active capturer must be able to deliver a full-chroma (RGB) source — the honest-downgrade