fix(capture): capture CPU frames once the encoder proves it can't import dmabufs

A dmabuf import the GPU driver refuses is refused identically on every
retry, but the only recovery above it was the encode-stall ladder: five
in-place encoder rebuilds, then the video session ends. So a host whose
driver will not take what its compositor allocates lost every session
on its first frame, and every reconnect repeated it — while the very
same host streamed fine with `PUNKTFUNK_ZEROCOPY=0`. The software knew
how to run that machine and never chose to.

Latch it, exactly as the sibling CUDA-import path already does after
repeated worker deaths: three consecutive import failures with no frame
in between disable the raw-dmabuf passthrough for the host process, and
capture negotiates CPU frames from the next session on. Three sits
below the encoder's rebuild budget, so the latch is set before the
session it doomed ends — one bad session, then a working (if slower)
host, with a log line saying which and why instead of an operator
having to find an environment variable.

Only the two stages that ARE the import are counted — the buffersrc
push of the DRM-PRIME descriptor and the buffersink pull where `hwmap`
maps it into a VA surface. `avcodec_send_frame` is deliberately left
out: that one is the encoder stalling, which the in-place rebuild
exists to recover, and taking zero-copy away permanently over a
transient fault would be a bad trade.

The latch lives in pf-zerocopy because it is the leaf both sides can
see — the capture→encode edge is one-way by design, so pf-capture
cannot ask pf-encode anything.

crates/pf-capture/src/linux/mod.rs

@@ -2191,7 +2191,15 @@ mod pipewire {
         // consumer imports raw dmabufs itself — the VAAPI backend (libva import + GPU CSC) or a
         // PyroWave session (the wavelet encoder's own Vulkan device, any vendor) → hand the raw
         // dmabuf straight to the encoder.
-        let vaapi_passthrough = zerocopy && !force_shm && importer.is_none() && raw_passthrough;
+        //
+        // ...unless the encoder already proved it cannot import them here. A driver that refuses
+        // the compositor's buffers refuses them identically on every retry, so without this the
+        // session died on its first frame and every reconnect repeated it. The latch (set by the
+        // encode side after consecutive import failures) is what turns that into one bad session
+        // followed by a working, if slower, host.
+        let raw_dmabuf_off = raw_passthrough && pf_zerocopy::raw_dmabuf_import_disabled();
+        let vaapi_passthrough =
+            zerocopy && !force_shm && importer.is_none() && raw_passthrough && !raw_dmabuf_off;
         // Producer-side NV12 (default-on; PUNKTFUNK_PIPEWIRE_NV12=0 escapes): gamescope offers a
         // one-fd LINEAR NV12 image when the consumer asks — its compositor pass does the RGB→YUV,
         // and the Vulkan Video encoder imports the buffer as its encode source directly (no host
@@ -2249,6 +2257,12 @@ mod pipewire {
             tracing::info!(
                 "capture: PUNKTFUNK_FORCE_SHM — race-free SHM download path (no dmabuf, no zero-copy)"
             );
+        } else if raw_dmabuf_off {
+            tracing::warn!(
+                "zero-copy raw-dmabuf passthrough disabled after repeated encoder import failures \
+                 — capturing CPU frames instead (this host's GPU driver would not import the \
+                 compositor's buffers)"
+            );
         } else if zerocopy && !want_dmabuf {
             tracing::warn!("zero-copy: no importable dmabuf modifiers — using CPU path");
         } else if vaapi_passthrough && policy.pyrowave_modifiers.is_empty() {