fix(host/windows): secure-desktop black screen — capture the real frame, don't seed black

Root cause (confirmed live: "black until I pressed a key, then the image came
back"): the secure desktop (lock/login/UAC) is STATIC, and DXGI Desktop
Duplication only emits a frame on CHANGE. On the normal→secure switch the
duplication is rebuilt (recreate_dupl / try_reduplicate), and we then SEEDED A
BLACK frame as last_present — which the static secure desktop never replaced
(no change-frame) until the user pressed a key. So we streamed black.

Fix: after rebuilding the duplication, CAPTURE the current desktop frame instead
of seeding black. A freshly-created duplication's first AcquireNextFrame returns
the full current desktop; grab it and present it. New `present_acquired` factors
the frame-processing out of `acquire`; both recovery paths now call it:
- recreate_dupl: after adopting the new duplication, acquire+present the real
  frame (born-lost ACCESS_LOST / no-initial-frame → seed black as fallback and
  let the 250ms-throttled caller retry — a brief flash, then real content).
- try_reduplicate: adopt-first, then capture its probe frame (was discarded).

Also (independently-correct safe fixes, per the adversarial review):
- DesktopWatcher computes the current desktop synchronously in start() before
  returning, so a session that begins on the secure desktop (reconnect to a
  locked box) doesn't relay one stale normal-desktop frame (the "flash").
- DuplCapturer::open reasserts SudoVDA isolation at open time (mirrors
  recreate_dupl) — forces the secure desktop back onto the virtual output if a
  lock/UAC re-attached a physical monitor.
- Instrumentation: dbg_black_seeds counter + a throttled warn when black is
  seeded, and an info when a real secure-desktop frame is captured on recovery.

Pending: the user's real-lock smoke test on the 4090 (a headless PsExec
LockWorkStation runs as SYSTEM and can't lock an interactive session, so this
must be validated with an actual lock).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/capture/desktop_watch.rs

@@ -29,14 +29,23 @@ pub struct DesktopWatcher {
 
 impl DesktopWatcher {
     pub fn start() -> Self {
-        let state = Arc::new(AtomicU8::new(DESKTOP_NORMAL));
+        // Compute the CURRENT desktop synchronously before returning, so the first reader (the capture
+        // mux) sees the real state immediately. Otherwise a session that begins already on the secure
+        // desktop (e.g. a reconnect to a locked box) would read DESKTOP_NORMAL for the first poll
+        // interval and relay one stale normal-desktop frame — the "flash of the login screen" bug.
+        let initial = if unsafe { is_secure_desktop() } {
+            DESKTOP_SECURE
+        } else {
+            DESKTOP_NORMAL
+        };
+        let state = Arc::new(AtomicU8::new(initial));
         let stop = Arc::new(AtomicBool::new(false));
         let s = state.clone();
         let st = stop.clone();
         let _ = std::thread::Builder::new()
             .name("desktop-watch".into())
             .spawn(move || {
-                let mut last = u8::MAX;
+                let mut last = initial;
                 while !st.load(Ordering::Relaxed) {
                     let v = if unsafe { is_secure_desktop() } {
                         DESKTOP_SECURE