feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2)

Frame ring (pf-vdisplay) and both gamepad SHM channels move off named Global\
objects (openable by any sibling LocalService) to UNNAMED sections/events whose
handles the host DuplicateHandles into the driver's verified WUDFHost with least
access — frame delivery over the SYSTEM+admins-only IOCTL_SET_FRAME_CHANNEL,
pads over a 32-byte named bootstrap mailbox (pid + handle value only, DoS-bounded;
HID minidrivers have no control device). Driver-validated pad_index kills
cross-pad redirects; v1↔v2 mixes fail closed with diagnosis logs on both sides.
Sibling-LocalService denial proven empirically (design/idd-push-security.md,
design/gamepad-channel-sealing.md).

Driver-side raw ops now live behind pf-umdf-util (checked shm accessors, the
forbid(unsafe_code) ChannelClient state machine, WDF request tokens) — the pad
drivers' logic is 100% safe Rust; whole drivers workspace clippy-gated in CI.

driver install --gamepad now sweeps SWD\punktfunk phantom devnodes: a re-created
SwDevice REVIVES the old devnode with its previously-bound driver (never
re-ranks), so an upgrade otherwise leaves the old driver serving — or, across
the v1→v2 fence, a dead pad (found live on the RTX box).

On-glass validated on the RTX 4090 box: frame path 7007 frames p50 2.06 ms
cross-machine; DualSense + XUSB "sealed pad channel mapped"/proto=2 attach via
both the test harness and a real streaming session; phantom-sweep repro.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/vdisplay/windows/manager.rs

@@ -39,11 +39,13 @@ pub(crate) enum MonitorKey {
     Session(u64),
 }
 
-/// What a backend's `add_monitor` returns: the REMOVE key + the OS target id + the render LUID.
+/// What a backend's `add_monitor` returns: the REMOVE key + the OS target id + the render LUID + the
+/// driver's WUDFHost pid (the sealed frame channel's handle-duplication target).
 pub(crate) struct AddedMonitor {
     pub key: MonitorKey,
     pub target_id: u32,
     pub luid: LUID,
+    pub wudf_pid: u32,
 }
 
 /// The backend-specific IOCTL surface — the *only* thing that differs between SudoVDA and pf-vdisplay.
@@ -91,6 +93,9 @@ struct Monitor {
     key: MonitorKey,
     target_id: u32,
     luid: LUID,
+    /// The driver's WUDFHost pid (from the ADD reply) — carried into [`WinCaptureTarget`] so the
+    /// IDD-push capturer knows where to duplicate the sealed frame channel's handles.
+    wudf_pid: u32,
     gdi_name: Option<String>,
     mode: Mode,
     stop: Arc<AtomicBool>,
@@ -109,6 +114,7 @@ impl Monitor {
                 adapter_luid: crate::capture::dxgi::pack_luid(self.luid),
                 gdi_name: n,
                 target_id: self.target_id,
+                wudf_pid: self.wudf_pid,
             })
     }
 }
@@ -166,6 +172,14 @@ pub(crate) fn vdm() -> &'static VirtualDisplayManager {
         .expect("VirtualDisplayManager used before a backend initialised it")
 }
 
+/// The live pf-vdisplay control-device handle, for the IDD-push capturer's sealed-channel delivery
+/// (`IOCTL_SET_FRAME_CHANNEL`). Safe to hand out as a bare `HANDLE`: the device lives in a `OnceLock`
+/// that is never cleared or closed for the process lifetime. `None` before the first backend open —
+/// impossible for a capturer, which only exists on a monitor the manager created.
+pub(crate) fn control_device_handle() -> Option<HANDLE> {
+    VDM.get().and_then(VirtualDisplayManager::device_handle)
+}
+
 impl VirtualDisplayManager {
     pub(crate) fn backend_name(&self) -> &'static str {
         self.driver.name()
@@ -436,6 +450,7 @@ impl VirtualDisplayManager {
             key: added.key,
             target_id: added.target_id,
             luid: added.luid,
+            wudf_pid: added.wudf_pid,
             gdi_name,
             mode,
             stop,