feat(dualsense): Phase C/D/E — virtual DualSense routing + 0xCC/0xCD planes + C ABI

PUNKTFUNK_GAMEPAD=dualsense now routes a session's gamepad through a real virtual
DualSense (UHID + hid-playstation) end to end:

- host: a `PadBackend` enum (m3.rs) selects `GamepadManager` (uinput xpad, default)
  or the new `DualSenseManager` (dualsense.rs) per session. The manager keeps each
  pad's full DsState so touchpad + motion (rich-input plane) persist across
  button/stick frames, and services the !Send /dev/uhid fd only on the input thread
  (which cycles <=4ms, so the GET_REPORT init handshake completes).
- feedback: `service()` now returns `DsFeedback { hidout, rumble }`. Motor rumble
  stays on the universal 0xCA plane (so non-DualSense clients still feel it; manager
  dedups change); lightbar / player LEDs / adaptive-trigger effects ride the new
  0xCD HID-output plane (host->client) as `HidOutput`.
- rich input: touchpad contacts + motion ride the 0xCC plane (client->host) as
  `RichInput`, applied via `DualSenseManager::apply_rich` (merged with button state;
  touch normalized 0..65535 -> the touchpad resolution).
- connector + C ABI: `NativeClient::next_hidout` / `send_rich_input`, exported as
  `punktfunk_connection_next_hidout` (-> PunktfunkHidOutput) and
  `punktfunk_connection_send_rich_input` (<- PunktfunkRichInput); header regenerated.
- reference client: `--rich-input-test` drives the DualSense touchpad + motion and
  logs the 0xCD feedback that comes back.

Validated live on-box: a synthetic-source m3-host + client-rs created the real
kernel DualSense, drove 0xCC, and decoded 12 live 0xCD events (the kernel's actual
lightbar/trigger init reports) with the data plane unaffected (600/600 frames).
Adversarial review fixes folded in: the input loop no longer skips the rich drain +
feedback pump on a dropped gamepad event, and the touch contact id is clamped to its
slot. Remaining: the Apple client renders triggers/rumble on a real DualSense.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/roadmap.md

@@ -85,9 +85,18 @@ select = a `pw_stream` with `Direction::Output` + `media.class=Audio/Source`.
   from gamepad frames; output report `0x02` is parsed for LED RGB, player LEDs, and **adaptive
   trigger effects (L2/R2)**. Protocol carries new side-planes: rich-input `0xCC`
   (touchpad/motion) + HID-output `0xCD` (LED/triggers). `/dev/uhid` udev rule shipped.
-  *Remaining (paused, resume-able):* route gamepad frames → `DualSensePad` behind
-  `PUNKTFUNK_GAMEPAD=dualsense`, wire the `0xCC`/`0xCD` back-channel end-to-end (+ C ABI
-  `next_hidout`/`send_rich_input`), and render adaptive triggers + rumble on the Apple client.
+- **Rich DualSense — Phase C/D/E end-to-end, validated live.** `PUNKTFUNK_GAMEPAD=dualsense`
+  selects a per-session `DualSenseManager` (the `PadBackend` enum in `m3.rs`): client gamepad frames
+  build the DualSense report; the kernel's feedback comes back as `HidOutput` on the **0xCD** plane
+  (lightbar / player LEDs / adaptive triggers) while **rumble stays on the universal 0xCA plane**
+  (so non-DualSense clients still feel it); touchpad + motion ride the **0xCC** rich-input plane
+  (`DualSenseManager::apply_rich`, merged with button state). The connector + C ABI gained
+  `punktfunk_connection_next_hidout` (→ `PunktfunkHidOutput`) and `punktfunk_connection_send_rich_input`
+  (← `PunktfunkRichInput`); header regenerated. Validated on-box: a synthetic-source `m3-host` +
+  `punktfunk-client-rs --rich-input-test` created the real kernel DualSense, drove 0xCC, and decoded
+  12 live 0xCD events (the kernel's actual lightbar/trigger init reports) — data plane unaffected
+  (600/600 frames). *Remaining:* the Apple client renders adaptive triggers + rumble on a real
+  DualSense (`GCDualSenseAdaptiveTrigger`) — handed off to the client agent for the real playtest.
 - **Advanced (audio-driven voice-coil) haptics — scoped, NO-GO for now (`docs/dualsense-haptics.md`).**
   Driven by the DualSense's USB *audio* interface (4-ch, back 2 channels = haptic PCM), not HID — so
   the UHID backend structurally can't carry it. Three independent walls: host capture needs a kernel