feat(nvenc): default-on the Linux direct-SDK NVENC path

On-glass validated 2026-07-12 on an RTX 5070 Ti host with a real Steam Deck
client (NV12 4:2:0, 1280x800@90): real nvEncInvalidateRefFrames landed 73/73
as clean P-frame recovery anchors (never IDR), losses consistently ~2 frames
deep — well inside the 5-frame DPB. That is the loss recovery the libav
hevc_nvenc path cannot express, so make the direct path the default on NVIDIA.

PUNKTFUNK_NVENC_DIRECT=0 (also false/no/off) is now the libav escape hatch.
Still gated on a CUDA capture payload — the `cuda` check in open_nvenc_probed
keeps AMD/Intel on VAAPI regardless, and the NVENC/CUDA entry points stay
dlopen'd at runtime (no new DT_NEEDED), so non-NVIDIA hosts are unaffected.
Packaging comments updated to match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/arch/PKGBUILD

@@ -71,7 +71,8 @@ build() {
   # anchor on Linux NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-SAFE: the NVENC/CUDA entry
   # points are dlopen'd at RUNTIME (libloading), never link-imported — `objdump -p` shows the same
   # DT_NEEDED as a plain build (no libcuda/libnvidia-encode), so the binary starts fine driver-less
-  # and only touches NVIDIA when a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT actually select it.
+  # and only touches NVIDIA on a CUDA capture frame (default on NVIDIA; PUNKTFUNK_NVENC_DIRECT=0
+  # opts back to libav). AMD/Intel never reach it — the `cuda` gate leaves them on VAAPI.
   cargo build --release --locked --features punktfunk-host/nvenc \
     -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray
   # Management web console (opt-in): the Nitro `bun`-preset .output bundle (Bun.serve TLS),

packaging/rpm/punktfunk.spec

@@ -178,7 +178,8 @@ export PUNKTFUNK_BUILD_VERSION="%{version}-%{release}"
 # --features punktfunk-host/nvenc: the direct-SDK NVENC path (real RFI + recovery anchor on Linux
 # NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-safe — the NVENC/CUDA entry points are dlopen'd
 # at runtime (no link-time dep; __requires_exclude already drops libcuda), so the binary starts
-# driver-less; the encoder is only built for a CUDA frame + PUNKTFUNK_NVENC_DIRECT, never on VAAPI.
+# driver-less; the encoder engages only on a CUDA frame (default on NVIDIA; PUNKTFUNK_NVENC_DIRECT=0
+# opts back to libav) — the `cuda` gate keeps AMD/Intel on VAAPI regardless.
 cargo build --release --locked --features punktfunk-host/nvenc \
   -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray