docs: VM handoff — CLAUDE.md, Ubuntu bootstrap, headless-Sway setup for M0

Prepares the move to the NVIDIA-GPU Ubuntu VM where M0/M2 run (macOS can't drive the
Wayland/GPU stack). The repo carries the context, since Claude Code sessions are
machine-local and don't transfer.

- CLAUDE.md: project state + design invariants + don't-regress security notes. Auto-loads
  every session, so a fresh session on the VM continues from here.
- scripts/bootstrap-ubuntu.sh: verifies the (already-installed) NVIDIA/NVENC stack,
  installs rustup + PipeWire/portal/wlroots/Sway + DRM/EGL/GBM/VA dev deps; GATES the
  FFmpeg -dev headers so apt can't clobber a custom NVENC build; checks nvidia-drm.modeset.
- scripts/headless/: headless-Sway + xdg-desktop-portal-wlr config templates, the
  NVIDIA-wlroots env workarounds, run-headless-sway.sh, and a wf-recorder->hevc_nvenc
  capture smoke test (proves capture->NVENC with no Rust).
- docs/linux-setup.md: M0 walkthrough + verified gotchas (modeset, headless backend,
  vGPU NVENC licensing, dmabuf->NVENC CPU-copy fallback, FFmpeg-dev gate, crate versions).

Ubuntu 24.04 package names/versions verified against the live archive; scripts pass
shellcheck and `bash -n`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/headless/sway.config

@@ -0,0 +1,10 @@
+# Minimal headless Sway config for the lumen M0 capture spike.
+# Under WLR_BACKENDS=headless, Sway 1.9 auto-creates one output named HEADLESS-1
+# (fixed 1920x1080); this just resizes it. For extra outputs: `swaymsg create_output`
+# (auto-named HEADLESS-2, ...). Set the resolution to your target client size.
+
+xwayland disable
+output HEADLESS-1 resolution 1920x1080 position 0 0
+
+# A terminal is handy when poking at the session over `swaymsg`.
+bindsym Mod4+Return exec foot