feat(host/steam): shippable usbip/vhci_hcd virtual Deck + client leave-shortcuts

Steam Deck pass-through (design/steam-deck-passthrough-plan.md), code-complete +
all CI checks green on Linux + adversarially reviewed; on-glass validation pending:

- usbip/`vhci_hcd` virtual Deck transport (inject/linux/steam_usbip.rs) for
  non-SteamOS hosts (Bazzite/generic) — presents a real interface-2 USB Deck so
  Steam Input promotes it. In-process vhci attach (loopback OP_REQ_IMPORT handshake
  → sysfs attach) with a bounded `usbip`-CLI fallback; detach on drop.
- Backed by a vendored, libusb-free trim of the `usbip` crate
  (crates/punktfunk-host/vendor/usbip-sim, MIT + NOTICE; host/cdc/hid + rusb/nusb
  removed; interrupt-IN paced by bInterval).
- Selection ladder raw_gadget (SteamOS fast-path) → usbip (universal) → UHID,
  with PUNKTFUNK_STEAM_USBIP / PUNKTFUNK_USBIP_ATTACH knobs.
- Shared Deck descriptors + the 0x83/0xAE feature contract + a Steam-accepted
  serial consolidated into steam_proto.rs; the raw_gadget backend reuses them.
- Linux client leave-shortcuts: Ctrl+Alt+Shift+D + holding the escape chord
  (L1+R1+Start+Select) >=1.5s end the session (short press still exits
  fullscreen); the chord state resets across sessions.

Also bundles in-progress work already staged in the tree:
- host(kwin): xdg-output logical-geometry mapping so the KWin fake_input backend
  places absolute coordinates correctly under display scaling.
- docs: design/README index entries + design/controller-only-mode.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/vendor/usbip-sim/Cargo.toml

@@ -0,0 +1,33 @@
+# Vendored + trimmed copy of the `usbip` crate (jiegec/usbip v0.8.0, MIT), reduced to the
+# USB/IP *server simulation* path only: we present a virtual Steam Deck and let the local
+# `vhci_hcd` attach it. The upstream crate hard-depends on `rusb`→`libusb1-sys` (for its USB
+# *host* mode, which we do not use and which would add a libusb runtime dep + break `musl`),
+# so the host modules (`host.rs`, the `rusb`/`nusb` device constructors) and the helper
+# interface handlers (`cdc.rs`/`hid.rs`) are removed. What remains — the device model, the
+# USB/IP protocol framing, and the `UsbInterfaceHandler` trait — is pure `std` + `tokio` and
+# carries no libusb dependency. See `NOTICE` for upstream attribution.
+[package]
+name = "usbip-sim"
+version = "0.8.0"
+edition = "2021"
+description = "Trimmed usbip server-simulation core (no libusb) — vendored for the virtual Steam Deck"
+license = "MIT"
+publish = false
+
+[lib]
+name = "usbip_sim"
+path = "src/lib.rs"
+
+[dependencies]
+log = "0.4"
+num-derive = "0.4"
+num-traits = "0.2"
+# `time` is for the interrupt-IN pacing added in device.rs (punktfunk modification — see NOTICE).
+tokio = { version = "1", features = ["rt", "net", "io-util", "sync", "time"] }
+# Upstream gated its struct derives behind a `serde` feature; kept (off by default) so the
+# `#[cfg(feature = "serde")]` attributes stay valid and the vendored diff stays minimal.
+serde = { version = "1", features = ["derive"], optional = true }
+
+[features]
+default = []
+serde = ["dep:serde"]