feat(host/steam): shippable usbip/vhci_hcd virtual Deck + client leave-shortcuts

Steam Deck pass-through (design/steam-deck-passthrough-plan.md), code-complete +
all CI checks green on Linux + adversarially reviewed; on-glass validation pending:

- usbip/`vhci_hcd` virtual Deck transport (inject/linux/steam_usbip.rs) for
  non-SteamOS hosts (Bazzite/generic) — presents a real interface-2 USB Deck so
  Steam Input promotes it. In-process vhci attach (loopback OP_REQ_IMPORT handshake
  → sysfs attach) with a bounded `usbip`-CLI fallback; detach on drop.
- Backed by a vendored, libusb-free trim of the `usbip` crate
  (crates/punktfunk-host/vendor/usbip-sim, MIT + NOTICE; host/cdc/hid + rusb/nusb
  removed; interrupt-IN paced by bInterval).
- Selection ladder raw_gadget (SteamOS fast-path) → usbip (universal) → UHID,
  with PUNKTFUNK_STEAM_USBIP / PUNKTFUNK_USBIP_ATTACH knobs.
- Shared Deck descriptors + the 0x83/0xAE feature contract + a Steam-accepted
  serial consolidated into steam_proto.rs; the raw_gadget backend reuses them.
- Linux client leave-shortcuts: Ctrl+Alt+Shift+D + holding the escape chord
  (L1+R1+Start+Select) >=1.5s end the session (short press still exits
  fullscreen); the chord state resets across sessions.

Also bundles in-progress work already staged in the tree:
- host(kwin): xdg-output logical-geometry mapping so the KWin fake_input backend
  places absolute coordinates correctly under display scaling.
- docs: design/README index entries + design/controller-only-mode.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/vendor/usbip-sim/src/setup.rs

@@ -0,0 +1,31 @@
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+/// Parse the SETUP packet of control transfers
+#[derive(Clone, Copy, Debug, Default)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub struct SetupPacket {
+    /// bmRequestType
+    pub request_type: u8,
+    /// bRequest
+    pub request: u8,
+    /// wValue
+    pub value: u16,
+    /// wIndex
+    pub index: u16,
+    /// wLength
+    pub length: u16,
+}
+
+impl SetupPacket {
+    /// Parse a [SetupPacket] from raw setup packet
+    pub fn parse(setup: &[u8; 8]) -> SetupPacket {
+        SetupPacket {
+            request_type: setup[0],
+            request: setup[1],
+            value: ((setup[3] as u16) << 8) | (setup[2] as u16),
+            index: ((setup[5] as u16) << 8) | (setup[4] as u16),
+            length: ((setup[7] as u16) << 8) | (setup[6] as u16),
+        }
+    }
+}