packaging(rpm): Fedora 44 build + ship the KDE session unit & host.env

Three changes to make a reproducible Fedora KDE host install:
- ci/fedora-rpm.Dockerfile: parameterize the Fedora base (ARG FEDORA_VERSION, default 43) so the
  same builder produces the Bazzite (F43, libavcodec.so.61) and Fedora 44 (libavcodec.so.62) RPMs.
  A binary RPM is soname-coupled to its base, so each target Fedora needs its own build/channel.
- spec: install punktfunk-kde-session.service (was in the tree but never packaged) with its
  ExecStart repointed from the dev source tree to the installed run-headless-kde.sh. This is the
  headless `kwin --virtual` session (KWIN_WAYLAND_NO_PERMISSION_CHECKS=1) the kwin backend needs —
  an interactive Plasma session refuses to hand its privileged zkde_screencast protocol to an
  external client, so a dedicated session is required. Not enabled by default (kwin hosts opt in).
- ship packaging/kde/host.env as host.env.kde — the ready KWin appliance config (wayland-kde).

Validated live on a Fedora 44 KDE box (RTX 4090): KWin virtual output + zero-copy dmabuf->CUDA->NVENC.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/kde/host.env

@@ -0,0 +1,12 @@
+# punktfunk host config for a Fedora/Ubuntu KDE Plasma appliance (kwin backend).
+# Copy to ~/.config/punktfunk/host.env. Pairs with punktfunk-kde-session.service, which brings
+# up a headless `kwin --virtual` on wayland-kde (with KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 so the
+# host can bind KWin's privileged zkde_screencast protocol — an interactive Plasma session will
+# NOT hand that protocol to an external client). The host streams a per-client virtual output
+# from that session, captured zero-copy (dmabuf -> CUDA -> NVENC) on NVIDIA.
+WAYLAND_DISPLAY=wayland-kde
+XDG_CURRENT_DESKTOP=KDE
+PUNKTFUNK_COMPOSITOR=kwin
+PUNKTFUNK_VIDEO_SOURCE=virtual
+PUNKTFUNK_ZEROCOPY=1
+PUNKTFUNK_INPUT_BACKEND=libei