docs(arch): fish-safe repo setup, firewalld services, fix client label

The pacman-repo setup step used a bash heredoc (`<<'EOF'`), which fish — the
default shell on CachyOS — cannot parse ("expected a string, but found a
redirection"). Replace it with a cross-shell `printf | sudo tee -a` form in both
the Arch guide and packaging/arch/README.md; `$repo`/`$arch` stay literal for
pacman and the output is byte-identical to the old heredoc.

Firewall: stock Arch ships none (ports already open), but CachyOS enables
firewalld by default and an Arch package must never touch the running firewall.
Ship firewalld service definitions the host package installs to
/usr/lib/firewalld/services/ (punktfunk-gamestream, punktfunk-native), not
auto-enabled; the install scriptlet prints the enable command only when
firewall-cmd is present. Document it in the Arch guide (new section) and README.
The mgmt API (loopback) and web console ports are deliberately not opened.

Also fix the "GTK4 couch/Deck client" mislabel — it's the native
GTK4/libadwaita Linux client (desktop/laptop/Deck are targets; the
controller-optimized launcher is one view, not its identity) — across the Arch
PKGBUILD/README, Arch guide, and the Debian README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/arch/README.md

@@ -1,9 +1,9 @@
 # punktfunk on Arch Linux / SteamOS
 
 Packaging for punktfunk on Arch and Arch-derived immutable distros. The `PKGBUILD` is a **split
-package** producing **`punktfunk-host`** (the gaming-rig host) and **`punktfunk-client`** (the GTK4
-couch/Deck client) — mirrors the rpm subpackages (`packaging/rpm/punktfunk.spec`) and the deb build
-scripts. On a **Steam Deck used as a client you want `punktfunk-client`** (it's what the
+package** producing **`punktfunk-host`** (the gaming-rig host) and **`punktfunk-client`** (the native
+GTK4/libadwaita Linux client) — mirrors the rpm subpackages (`packaging/rpm/punktfunk.spec`) and the
+deb build scripts. On a **Steam Deck used as a client you want `punktfunk-client`** (it's what the
 [Decky plugin](../../clients/decky/) launches); on a gaming rig, `punktfunk-host`.
 
 > **Steam Deck as a HOST:** don't use this PKGBUILD — SteamOS's read-only root makes `makepkg`/sysext
@@ -42,15 +42,13 @@ curl -fsS https://git.unom.io/api/packages/unom/arch/repository.key \
 sudo pacman-key --lsign-key E0CA04465C99C936E0B0C6510A317015A34DDD69
 
 # 2. Add the repo (pick ONE channel — punktfunk for releases, punktfunk-canary for main builds).
-sudo tee -a /etc/pacman.conf >/dev/null <<'EOF'
-
-[punktfunk]
-Server = https://git.unom.io/api/packages/unom/arch/$repo/$arch
-EOF
+#    printf, not a heredoc, so this works in fish too (CachyOS's default shell has no `<<EOF`).
+printf '\n[punktfunk]\nServer = https://git.unom.io/api/packages/unom/arch/$repo/$arch\n' \
+  | sudo tee -a /etc/pacman.conf >/dev/null
 
 # 3. Sync + install.
 sudo pacman -Sy punktfunk-host        # gaming rig
-sudo pacman -Sy punktfunk-client      # couch/Deck side
+sudo pacman -Sy punktfunk-client      # the native GTK4 Linux client
 sudo pacman -Sy punktfunk-web         # optional browser management console
 ```
 
@@ -139,7 +137,31 @@ so it's a much lighter sysext than the host.
 
 ## Firewall
 
-If the host box runs a firewall, open the ports it listens on. The **native `punktfunk/1`** plane:
+**Stock Arch ships no firewall** — every port is open by default, so there is nothing to do.
+Spins that enable one **do not** get their ports opened for you: an Arch package never touches the
+admin's running firewall. **CachyOS is the common case** — its installer turns on `firewalld` by
+default, so out of the box the host is unreachable until you allow it.
+
+The `punktfunk-host` package ships **firewalld service definitions** (installed to
+`/usr/lib/firewalld/services/`) so enabling is one command — pick the plane your host serves:
+
+```sh
+# Reload once so firewalld picks up the just-installed service definition, add it, reload to apply.
+sudo firewall-cmd --reload
+sudo firewall-cmd --permanent --add-service=punktfunk-gamestream   # Moonlight/GameStream host
+#                              --add-service=punktfunk-native       # …or the native-only host
+sudo firewall-cmd --reload
+```
+
+`punktfunk-gamestream` opens the fixed Moonlight ports + mDNS; `punktfunk-native` opens the QUIC
+control port (UDP 9777) + mDNS. Enable both if the host runs `serve --gamestream` (which serves
+both planes). The **data plane is an *ephemeral* UDP port** negotiated per session, so there is no
+fixed data port in either service; a restrictive firewall must additionally allow a UDP range (the
+project does not pin one). The mgmt REST API (TCP 47990) binds to loopback by default — leave it
+closed unless you move it off loopback with `--mgmt-bind IP:PORT` (which then requires
+`--mgmt-token`).
+
+For a non-firewalld setup, open the ports directly. The **native `punktfunk/1`** plane:
 
 - **QUIC control plane: UDP 9777** (`serve --native-port N` to change).
 - **Data plane: an *ephemeral* UDP port** — negotiated per session, so there is no fixed port to
@@ -182,6 +204,9 @@ udp dport { 47998-48010, 5353 } accept
 - `PKGBUILD` — split package: `punktfunk-host` + `punktfunk-client` (builds the working tree via
   `PF_SRCDIR`, or a git tag for AUR).
 - `punktfunk-host.install` / `punktfunk-client.install` — pacman scriptlets (udev reload + sysctl +
-  first-run hint), mirror the RPM `%post` / deb postinst.
+  first-run hint, incl. the firewalld enable command when firewalld is present), mirror the RPM
+  `%post` / deb postinst.
+- `punktfunk-gamestream.xml` / `punktfunk-native.xml` — firewalld service definitions the host
+  package installs to `/usr/lib/firewalld/services/` (not auto-enabled; see Firewall above).
 - `build-sysext.sh` — wraps either built `.pkg.tar.zst` into a `systemd-sysext` `.raw` for SteamOS
   (derives the name from the package, so it works for host or client).