feat: M0 capture→encode pipeline + M2 GameStream host (pairing, RTSP, video)

M0 (lumen-host) — verified on NVIDIA RTX 5070 Ti / Ubuntu 25.10:
headless wlroots → xdg ScreenCast portal → PipeWire → NVENC HEVC → playable file,
with each access unit round-tripped through a lumen_core host↔client Session
(FEC + packetize + reassemble), 0 mismatches.
- capture.rs: SyntheticCapturer + portal capture (ashpd 0.13 + pipewire 0.9), format-aware
- encode/linux.rs: NVENC via ffmpeg-next 7 (BGRx/RGB → rgb0, no host-side swscale)
- m0.rs: capture→encode→file + lumen-core loopback verification

M2 P1 (lumen-host gamestream/) — a stock Moonlight client pairs + launches, verified live:
- mDNS _nvstream._tcp + nvhttp /serverinfo (HTTP 47989, mutual-TLS HTTPS 47984)
- 4-phase pairing: PIN→AES-128-ECB / SHA-256 / RSA-PKCS1v15 / X.509, custom rustls
  ClientCertVerifier for the mutual-TLS pairchallenge
- /applist, /launch (rikey/rikeyid/mode), hand-rolled RTSP (OPTIONS/DESCRIBE/SETUP×3/
  ANNOUNCE/PLAY, one-request-per-TCP-connection per moonlight-common-c's read-to-EOF)
- video.rs: GameStream RTP + NV_VIDEO_PACKET wire packetizer, data-shards-only (0% FEC,
  clean-LAN), unit-tested (single/multi-block)

Docs: docs/m2-plan.md (phased plan) + docs/research/ (ground-truth protocol spec).
Bootstrap/setup updated for the verified path (libnvidia-gl, render/video groups, GPU
EGL, pipewire 0.9). Workspace clippy-clean, tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/headless/run-headless-sway.sh

@@ -1,20 +1,35 @@
 #!/usr/bin/env bash
-# Launch headless Sway on the NVIDIA VM with a private D-Bus session so the ScreenCast
-# portal activates. Prints the WAYLAND_DISPLAY (default wayland-1) to use from other shells.
+# Launch headless Sway on the NVIDIA box for the lumen M0 capture spike.
 #
-# Prereq: scripts/bootstrap-ubuntu.sh has run and nvidia-drm.modeset=Y (reboot if not).
+# Runs on the user's *shared* session bus (NOT a private dbus-run-session) so that the
+# ScreenCast portal (xdg-desktop-portal-wlr) and the lumen host share one bus. After this
+# is up, run `prepare-session.sh` from a second shell to set the mode + portal env.
+#
+# Prereqs (see docs/linux-setup.md / scripts/bootstrap-ubuntu.sh):
+#   - nvidia-drm.modeset=Y
+#   - the NVIDIA GL/EGL userspace (libnvidia-gl-NNN) — provides libEGL_nvidia + the GLVND
+#     vendor JSON; without it wlroots can't init EGL on the GPU and falls back to pixman,
+#     which the ScreenCast portal cannot capture.
+#   - membership in the `render` + `video` groups (re-login after `usermod -aG`).
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$HERE/env.sh"
+export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=$XDG_RUNTIME_DIR/bus}"
 mkdir -p "$XDG_RUNTIME_DIR" 2>/dev/null || true
 chmod 700 "$XDG_RUNTIME_DIR" 2>/dev/null || true
 
-echo "starting headless Sway (renderer=$WLR_RENDERER). From another shell on this user:"
-echo "    export XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR WAYLAND_DISPLAY=wayland-1"
-echo "    swaymsg -t get_outputs        # expect HEADLESS-1"
+echo "starting headless Sway (renderer=$WLR_RENDERER) on bus $DBUS_SESSION_BUS_ADDRESS"
+echo "from another shell on this user:    bash $HERE/prepare-session.sh"
 echo
 
-# --unsupported-gpu is mandatory on Sway 1.9 with the proprietary NVIDIA driver.
-exec dbus-run-session -- sway --unsupported-gpu
+# wlroots opens the render node (/dev/dri/renderD128, group 'render'); NVIDIA's EGL uses it.
+# If this login predates `usermod -aG render,video` (groups not yet active), bridge with
+# `sg render` for this launch. The clean fix is to re-login so the groups apply natively.
+if id -nG | tr ' ' '\n' | grep -qx render; then
+    exec sway --unsupported-gpu
+else
+    echo "note: 'render' group not active in this login — bridging via 'sg render' (re-login to avoid)"
+    exec sg render -c 'sway --unsupported-gpu'
+fi