refactor(host/W6.1): extract the config() global into the pf-host-config leaf crate

Third de-coupling for the host crate carve (plan §W6.1 leaf). HostConfig + the config()
OnceLock (config.rs, pure std, zero deps) move to a new pf-host-config leaf so every
subsystem crate (pf-encode/pf-capture/pf-vdisplay/pf-gpu) can read process config WITHOUT
depending on the orchestrator. 34 crate::config::config() call sites across 19 files
repoint to pf_host_config::config(). thread_qos stays in the host for now (it calls
session_tuning::on_hot_thread — its own leaf-ification rides the encode carve).

Granular-crate decision (supersedes the plan's single pf-media): split capture/encode/
vdisplay into separate crates rather than one broad crate — the capture↔encode cycle is
broken by a shared frame-types leaf, and vdisplay→encode (can_open_another_session) is a
legal one-way edge since encode never references vdisplay.

Verified: Linux (home-worker-5) clippy -p pf-host-config -p punktfunk-host --all-targets
-D warnings; Windows (192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/native/compositor.rs

@@ -57,7 +57,7 @@ pub(super) fn resolve_compositor(
         crate::vdisplay::cancel_pending_tv_restore();
         // Explicit operator override (legacy / CI / forcing a backend for a test) wins and is assumed
         // to come with a hand-set env — don't retarget the process env in that case.
-        let overridden = crate::config::config().compositor.is_some();
+        let overridden = pf_host_config::config().compositor.is_some();
         let detected = if overridden {
             crate::vdisplay::detect().ok()
         } else {

crates/punktfunk-host/src/native/gamepad.rs

@@ -200,7 +200,7 @@ fn degrade_steam_on_conflict(chosen: GamepadPref) -> GamepadPref {
 /// Resolve the client's gamepad-backend preference (the env/logging shell around
 /// [`pick_gamepad`]). Always concrete — the `Welcome` reports what the session will drive.
 pub(super) fn resolve_gamepad(pref: GamepadPref) -> GamepadPref {
-    let env = crate::config::config().gamepad.clone();
+    let env = pf_host_config::config().gamepad.clone();
     let chosen = pick_gamepad(
         pref,
         env.as_deref(),

crates/punktfunk-host/src/native/handshake.rs

@@ -207,7 +207,7 @@ pub(super) async fn negotiate(
     // Welcome, exactly like the 4:4:4 gate below, so `color` reflects what we'll really emit —
     // the honest-downgrade channel: a GPU/backend that can't 10-bit yields 8-bit AND an SDR
     // label that matches the stream.
-    let host_wants_10bit = crate::config::config().ten_bit;
+    let host_wants_10bit = pf_host_config::config().ten_bit;
     let client_supports_10bit = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_10BIT != 0;
     // The GPU probe may open a tiny encoder on first use, so run it off the reactor like the
     // 4:4:4 probe below (blocking probes → spawn_blocking), short-circuited behind the cheap
@@ -239,7 +239,7 @@ pub(super) async fn negotiate(
     // what we'll really emit — the honest-downgrade channel: if any gate fails the client is
     // told 4:2:0 before it builds its decoder. The probe opens a tiny encoder; it runs only
     // when the earlier gates pass and is cached after the first.
-    let host_wants_444 = crate::config::config().four_four_four;
+    let host_wants_444 = pf_host_config::config().four_four_four;
     let client_supports_444 = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_444 != 0;
     // The active capturer must be able to deliver a full-chroma (RGB) source — the honest-downgrade
     // gate. Linux's portal capturer can; the Windows IDD-push path delivers subsampled NV12/P010

crates/punktfunk-host/src/native/stream.rs

@@ -873,7 +873,7 @@ pub(super) fn virtual_stream(ctx: SessionContext) -> Result<()> {
     #[cfg(not(any(target_os = "windows", target_os = "linux")))]
     let _ = &launch;
 
-    let perf = crate::config::config().perf;
+    let perf = pf_host_config::config().perf;
     // Microburst cap (applied in send_loop/paced_submit): a frame ≤ the cap bursts out
     // immediately; only a bigger frame's overflow is spread. `None` = auto — max(128 KB, the
     // AU's wire bytes / 4), so the burst stays a bounded fraction of high-rate frames instead
@@ -956,7 +956,7 @@ pub(super) fn virtual_stream(ctx: SessionContext) -> Result<()> {
     // place when the box flips Gaming↔Desktop. When not spawned, session_rx just stays empty.
     let mut compositor = compositor;
     let (session_tx, session_rx) = std::sync::mpsc::channel::<SessionSwitch>();
-    let watch = session_watch_enabled() && crate::config::config().compositor.is_none();
+    let watch = session_watch_enabled() && pf_host_config::config().compositor.is_none();
     let _watcher = if watch {
         tracing::info!("session watcher on — following a mid-stream Gaming↔Desktop switch");
         let stop = stop.clone();
@@ -1461,7 +1461,7 @@ pub(super) fn virtual_stream(ctx: SessionContext) -> Result<()> {
                 let (new_cap, new_enc, new_frame, new_interval, new_node_id, new_display_gen) = loop {
                     // Follow the active session unless an explicit PUNKTFUNK_COMPOSITOR pin forbids
                     // retargeting (then we stick to the pinned backend and just rebuild it).
-                    if crate::config::config().compositor.is_none() {
+                    if pf_host_config::config().compositor.is_none() {
                         let active = crate::vdisplay::detect_active_session();
                         // A4: fold any compositor-instance change into the epoch/invalidation before we
                         // rebuild, so the rebuild's acquire won't reuse a dead-instance node.