feat: M0 capture→encode pipeline + M2 GameStream host (pairing, RTSP, video)

M0 (lumen-host) — verified on NVIDIA RTX 5070 Ti / Ubuntu 25.10:
headless wlroots → xdg ScreenCast portal → PipeWire → NVENC HEVC → playable file,
with each access unit round-tripped through a lumen_core host↔client Session
(FEC + packetize + reassemble), 0 mismatches.
- capture.rs: SyntheticCapturer + portal capture (ashpd 0.13 + pipewire 0.9), format-aware
- encode/linux.rs: NVENC via ffmpeg-next 7 (BGRx/RGB → rgb0, no host-side swscale)
- m0.rs: capture→encode→file + lumen-core loopback verification

M2 P1 (lumen-host gamestream/) — a stock Moonlight client pairs + launches, verified live:
- mDNS _nvstream._tcp + nvhttp /serverinfo (HTTP 47989, mutual-TLS HTTPS 47984)
- 4-phase pairing: PIN→AES-128-ECB / SHA-256 / RSA-PKCS1v15 / X.509, custom rustls
  ClientCertVerifier for the mutual-TLS pairchallenge
- /applist, /launch (rikey/rikeyid/mode), hand-rolled RTSP (OPTIONS/DESCRIBE/SETUP×3/
  ANNOUNCE/PLAY, one-request-per-TCP-connection per moonlight-common-c's read-to-EOF)
- video.rs: GameStream RTP + NV_VIDEO_PACKET wire packetizer, data-shards-only (0% FEC,
  clean-LAN), unit-tested (single/multi-block)

Docs: docs/m2-plan.md (phased plan) + docs/research/ (ground-truth protocol spec).
Bootstrap/setup updated for the verified path (libnvidia-gl, render/video groups, GPU
EGL, pipewire 0.9). Workspace clippy-clean, tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/headless/prepare-session.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Run AFTER headless Sway is up (run-headless-sway.sh), from a second shell on the same
+# user. It: (1) points this shell at the running Sway, (2) gives HEADLESS-1 a real refresh
+# clock (an idle/0 mHz output produces no frames), (3) imports the env the ScreenCast portal
+# needs to find Sway and pick the wlr backend, and (4) writes /tmp/lumen-sway-env.sh so
+# other shells (e.g. `cargo run -p lumen-host`) can `source` it.
+#
+# Usage: bash scripts/headless/prepare-session.sh [WxH@RHz]   (default 1920x1080@60Hz)
+set -euo pipefail
+
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+export WAYLAND_DISPLAY="${WAYLAND_DISPLAY:-wayland-1}"
+export XDG_CURRENT_DESKTOP=sway
+export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=$XDG_RUNTIME_DIR/bus}"
+SWAYSOCK="$(ls -t "$XDG_RUNTIME_DIR"/sway-ipc.*.sock 2>/dev/null | head -1)"
+export SWAYSOCK
+MODE="${1:-1920x1080@60Hz}"
+
+if ! swaymsg -t get_outputs >/dev/null 2>&1; then
+    echo "Sway IPC not reachable ($SWAYSOCK) — is run-headless-sway.sh running?" >&2
+    exit 1
+fi
+
+# A real refresh clock so the compositor actually drives frames (and screencopy/PipeWire
+# get content). Without on-screen motion the screen is static; launch something animated
+# (e.g. `swaymsg exec foot`) to exercise the encoder.
+swaymsg output HEADLESS-1 mode "$MODE" >/dev/null
+echo "HEADLESS-1 set to $MODE"
+
+# The portal (xdg-desktop-portal-wlr) is D-Bus/systemd activated and must inherit these to
+# find the compositor and select the wlr ScreenCast backend.
+systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK XDG_RUNTIME_DIR 2>/dev/null || true
+dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK 2>/dev/null || true
+
+cat > /tmp/lumen-sway-env.sh <<EOF
+export XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR
+export WAYLAND_DISPLAY=$WAYLAND_DISPLAY
+export XDG_CURRENT_DESKTOP=sway
+export DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS
+export SWAYSOCK=$SWAYSOCK
+EOF
+
+cat <<EOF
+session ready. From any shell on this user:
+    source /tmp/lumen-sway-env.sh
+    swaymsg exec foot          # optional: animated on-screen content
+    cargo run -p lumen-host -- m0 --source portal --seconds 5 --out /tmp/lumen-m0.h265
+    ffprobe /tmp/lumen-m0.h265
+EOF