ci+docs: Fedora 44 RPM channel + reproducible Fedora KDE host guide

- docker.yml: build the punktfunk-fedora44-rpm builder image (parameterized Dockerfile,
  FEDORA_VERSION=44) alongside the F43/Bazzite one.
- rpm.yml: matrix the build/publish over both channels — fedora-fedora-rpm→bazzite (F43,
  libavcodec.so.61) and fedora44-rpm→fedora-44 (F44, libavcodec.so.62). fail-fast:false so one
  channel's break doesn't sink the other. (Bootstrap: the F44 builder image must be pushed by
  docker.yml once before rpm.yml's fedora-44 job can pull it — same dance as the other images.)
- fedora-kde.md: rewrite as the reproducible RPM-install guide validated live on a Fedora 44
  KDE box (RTX 4090): RPM Fusion + akmod-nvidia + the ffmpeg-free→RPM-Fusion swap for NVENC +
  Secure Boot MOK enroll; the fedora-44 dnf repo + `dnf install punktfunk`; and the headless
  punktfunk-kde-session.service (kwin --virtual with NO_PERMISSION_CHECKS — an interactive
  Plasma session won't hand its privileged zkde_screencast protocol to an external client).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/docker.yml

@@ -42,6 +42,11 @@ jobs:
           - image: punktfunk-fedora-rpm
             dockerfile: ci/fedora-rpm.Dockerfile
             context: ci
+          # Fedora 44 builder (Fedora KDE spin): same Dockerfile, newer base → libavcodec.so.62.
+          - image: punktfunk-fedora44-rpm
+            dockerfile: ci/fedora-rpm.Dockerfile
+            context: ci
+            buildargs: --build-arg FEDORA_VERSION=44
     steps:
       - uses: actions/checkout@v4
 
@@ -53,7 +58,7 @@ jobs:
 
       - name: Build
         run: |
-          docker build --pull \
+          docker build --pull ${{ matrix.buildargs }} \
             -f "${{ matrix.dockerfile }}" \
             -t "$REGISTRY/$OWNER/${{ matrix.image }}:latest" \
             -t "$REGISTRY/$OWNER/${{ matrix.image }}:sha-${GITHUB_SHA::8}" \