ci+docs: Fedora 44 RPM channel + reproducible Fedora KDE host guide

- docker.yml: build the punktfunk-fedora44-rpm builder image (parameterized Dockerfile,
  FEDORA_VERSION=44) alongside the F43/Bazzite one.
- rpm.yml: matrix the build/publish over both channels — fedora-fedora-rpm→bazzite (F43,
  libavcodec.so.61) and fedora44-rpm→fedora-44 (F44, libavcodec.so.62). fail-fast:false so one
  channel's break doesn't sink the other. (Bootstrap: the F44 builder image must be pushed by
  docker.yml once before rpm.yml's fedora-44 job can pull it — same dance as the other images.)
- fedora-kde.md: rewrite as the reproducible RPM-install guide validated live on a Fedora 44
  KDE box (RTX 4090): RPM Fusion + akmod-nvidia + the ffmpeg-free→RPM-Fusion swap for NVENC +
  Secure Boot MOK enroll; the fedora-44 dnf repo + `dnf install punktfunk`; and the headless
  punktfunk-kde-session.service (kwin --virtual with NO_PERMISSION_CHECKS — an interactive
  Plasma session won't hand its privileged zkde_screencast protocol to an external client).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/docker.yml

@@ -42,6 +42,11 @@ jobs:
           - image: punktfunk-fedora-rpm
             dockerfile: ci/fedora-rpm.Dockerfile
             context: ci
+          # Fedora 44 builder (Fedora KDE spin): same Dockerfile, newer base → libavcodec.so.62.
+          - image: punktfunk-fedora44-rpm
+            dockerfile: ci/fedora-rpm.Dockerfile
+            context: ci
+            buildargs: --build-arg FEDORA_VERSION=44
     steps:
       - uses: actions/checkout@v4
 
@@ -53,7 +58,7 @@ jobs:
 
       - name: Build
         run: |
-          docker build --pull \
+          docker build --pull ${{ matrix.buildargs }} \
             -f "${{ matrix.dockerfile }}" \
             -t "$REGISTRY/$OWNER/${{ matrix.image }}:latest" \
             -t "$REGISTRY/$OWNER/${{ matrix.image }}:sha-${GITHUB_SHA::8}" \

.gitea/workflows/rpm.yml

@@ -19,13 +19,23 @@ on:
 env:
   REGISTRY: git.unom.io
   OWNER: unom
-  RPM_GROUP: bazzite
 
 jobs:
   build-publish:
     runs-on: ubuntu-24.04
+    # One RPM per target whose ffmpeg soname must match (a binary RPM is soname-coupled to its
+    # base): Fedora 43 == Bazzite (libavcodec.so.61), Fedora 44 == the Fedora KDE spin (.so.62).
+    # Each builds in its matching builder image and publishes to its own registry group.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: punktfunk-fedora-rpm     # Fedora 43 == Bazzite base
+            group: bazzite
+          - image: punktfunk-fedora44-rpm   # Fedora 44 == Fedora KDE spin
+            group: fedora-44
     container:
-      image: git.unom.io/unom/punktfunk-fedora-rpm:latest
+      image: git.unom.io/unom/${{ matrix.image }}:latest
     timeout-minutes: 90
     env:
       CARGO_HOME: /usr/local/cargo
@@ -72,6 +82,6 @@ jobs:
             case "$rpm" in *debuginfo*|*debugsource*) echo "skip $rpm"; continue;; esac
             echo "uploading $rpm"
             curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$rpm" \
-              "https://$REGISTRY/api/packages/$OWNER/rpm/$RPM_GROUP/upload"
+              "https://$REGISTRY/api/packages/$OWNER/rpm/${{ matrix.group }}/upload"
           done
-          echo "published to $OWNER/rpm/$RPM_GROUP"
+          echo "published to $OWNER/rpm/${{ matrix.group }}"