chore(release): bump workspace version to 0.8.3

Release 0.8.3: the native Linux client is re-architected — the GTK4 shell + GL
presenter give way to a two-binary design (phases 0–6). A relm4/libadwaita
desktop shell (host discovery, pairing, library) now hands desktop connects to a
dedicated Vulkan session binary, punktfunk-session: an SDL3 window + ash
presenter carrying a Skia "console" UI — stats OSD, capture HUD, and a
gamepad-navigable coverflow library with --browse. The split lands the streaming
wins the GL path couldn't: VAAPI dmabuf → Vulkan zero-copy import + CSC (no GL
round-trip), Vulkan Video decode on the presenter's own device for NVIDIA
hardware decode (via a new pf-ffvk bindgen shim over FFmpeg's Vulkan hwcontext),
and HDR10/P010 end to end. The console background is now an animated mesh gradient
matching the Apple client's MeshGradient. Along the way: a resize crash fixed
(never vkDeviceWaitIdle while the pump decodes), keyframe recovery when the
decoder produces no output, decode-stage stats that measure GPU completion, an
Alt+Enter fullscreen alias, pointer-lock + per-iteration motion-flush input
fixes, and the host-card hover highlight made concentric.

Packaging + Decky: the flatpak now builds and ships BOTH client binaries (shell +
session) so the Deck's stream/browse paths survive the split — the session
binary's Skia is fetched offline from a pinned, sha256-verified archive; the
mgmt/library port 47990 is opened on the LAN firewall profiles; and the plugin's
install-from-URL uses the unom.io/pf-decky short link.

Other clients + core: Windows gains the two missing stream shortcuts
(Ctrl+Alt+Shift+S stats, F11 fullscreen) plus an in-stream shortcut reference on
both clients; Android promotes the low-latency pipeline to default and attaches
its APK to CI; the host coalesces keyframe-request storms into one IDR per
cooldown; the core jumps to live on a standing receive backlog instead of
ratcheting latency; and two security bumps clear the audits (crossbeam-epoch
RUSTSEC-2026-0204, vulnerable web transitive deps).

The [workspace.package] version (inherited by every crate via version.workspace)
is the release being cut; refresh the 14 workspace entries in Cargo.lock to match
(CI builds --locked). Canary derives from the tag as minor+1 of the latest stable
(scripts/ci/pf-version.sh), so with 0.8.3 the newest stable it stays at 0.9.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -2154,7 +2154,7 @@ dependencies = [
 
 [[package]]
 name = "latency-probe"
-version = "0.8.2"
+version = "0.8.3"
 
 [[package]]
 name = "lazy_static"
@@ -2286,7 +2286,7 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "loss-harness"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "punktfunk-core",
 ]
@@ -2767,7 +2767,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pf-client-core"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -2787,7 +2787,7 @@ dependencies = [
 
 [[package]]
 name = "pf-console-ui"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "ash",
@@ -2807,7 +2807,7 @@ dependencies = [
 
 [[package]]
 name = "pf-ffvk"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "ash",
  "bindgen",
@@ -2816,7 +2816,7 @@ dependencies = [
 
 [[package]]
 name = "pf-presenter"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "ash",
@@ -2999,7 +2999,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-android"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "android_logger",
  "jni",
@@ -3014,7 +3014,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-linux"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3030,7 +3030,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-session"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "pf-client-core",
@@ -3044,7 +3044,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-client-windows"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3067,7 +3067,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-core"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "aes-gcm",
  "bytes",
@@ -3098,7 +3098,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-host"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -3170,7 +3170,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-probe"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "mdns-sd",
@@ -3184,7 +3184,7 @@ dependencies = [
 
 [[package]]
 name = "punktfunk-tray"
-version = "0.8.2"
+version = "0.8.3"
 dependencies = [
  "anyhow",
  "ksni",

Cargo.toml

@@ -22,7 +22,7 @@ members = [
 exclude = ["packaging/linux/steam-deck-gadget/usbip-poc"]
 
 [workspace.package]
-version = "0.8.2"
+version = "0.8.3"
 edition = "2021"
 rust-version = "1.82"
 license = "MIT OR Apache-2.0"

api/openapi.json

@@ -10,7 +10,7 @@
       "name": "MIT OR Apache-2.0",
       "identifier": "MIT OR Apache-2.0"
     },
-    "version": "0.8.2"
+    "version": "0.8.3"
   },
   "paths": {
     "/api/v1/clients": {