feat(packaging/bazzite): one-shot KDE Desktop-mode setup for the host

The session-aware selector drives a KWin virtual output at the client's
resolution when the Bazzite box is in KDE Desktop Mode — validated live. But a
normal KDE login withholds two things the headless host needs:
  1. KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 — so KWin exposes the privileged
     zkde_screencast virtual-output protocol to an external client.
  2. the kde-authorized RemoteDesktop grant — so libei input auto-approves
     instead of popping a dialog a headless host can't answer.

Add packaging/bazzite/kde-desktop-setup.sh (idempotent, no root): writes the
environment.d KWIN drop-in and seeds the grant DB (shipped at
/usr/share/punktfunk/headless/kde-authorized) into ~/.local/share/flatpak/db/,
restarting the portal chain. Ship it via the RPM at
/usr/share/punktfunk/bazzite/ and document it in the Bazzite README (new §6.5).
Gaming Mode needs none of this (auto-attach).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/bazzite/README.md

@@ -291,6 +291,28 @@ sudo firewall-cmd --permanent --add-port=9777/udp && sudo firewall-cmd --reload
 
 ---
 
+## 6.5 Desktop (KDE) mode — stream the desktop at the client's resolution (optional)
+
+The host **auto-detects** the live session per connect: in **Steam Gaming Mode** it attaches to the
+running gamescope (no setup); switch the box to the **KDE Desktop** and it drives a KWin *virtual
+output at the connecting client's exact resolution* (no TV-stretch, churn-free). The Desktop path
+needs one one-shot setup the first time, because a normal KDE login withholds two things the
+headless host needs — the privileged `zkde_screencast` virtual-output protocol, and an
+auto-approved RemoteDesktop input grant:
+
+```sh
+bash /usr/share/punktfunk/bazzite/kde-desktop-setup.sh
+# then log out + back into the KDE Desktop session once (or reboot) so KWin restarts with the flag
+```
+
+That writes `~/.config/environment.d/10-punktfunk-kwin.conf`
+(`KWIN_WAYLAND_NO_PERMISSION_CHECKS=1`) and seeds the `kde-authorized` RemoteDesktop grant into
+`~/.local/share/flatpak/db/`. Gaming Mode is unaffected. To connect from Desktop Mode, switch to it
+(Steam → Power → Switch to Desktop), then connect the client; switching **mid-stream** requires a
+reconnect (the host resolves the backend per connect).
+
+---
+
 ## 7. Verify it's working
 
 **1. Watch the startup log:**