feat(host+inject): pen P1 — per-session uinput virtual tablet, HOST_CAP_PEN live

The Linux injection leg of design/pen-tablet-input.md: 0xCC/0x05 pen batches now
route through the per-session PenTracker into a lazily-created 'Punktfunk Pen'
uinput tablet (BTN_TOOL_PEN/RUBBER, pressure, tilt-from-polar, ABS_Z barrel
roll, hover distance, INPUT_PROP_DIRECT) — compositors pick it up via libinput
and hand apps zwp_tablet_v2 with full fidelity. The host now advertises
HOST_CAP_PEN when /dev/uinput is accessible (PUNKTFUNK_PEN=0 kill-switch);
transitions group into SYN frames so proximity-enter carries its position.
Stroke failsafe: clients heartbeat ≤100ms while in range (documented wire
contract — capture APIs are silent for a stationary pen); 200ms of silence
force-releases. 'punktfunk-host pen-test' draws a pressure-ramped sine stroke
through the real tracker→uinput chain, no client needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/client/mod.rs

@@ -1091,6 +1091,11 @@ impl NativeClient {
     /// Best-effort like every datagram: a lost batch self-heals on the next one (the samples
     /// carry full state, the host diffs — see [`crate::quic::PenTracker`]).
     ///
+    /// **Heartbeat contract**: while the pen is in range or touching, repeat the last sample
+    /// at least every ~100 ms even when nothing changed (capture APIs are silent for a
+    /// stationary pen) — the host force-releases the stroke after
+    /// [`crate::quic::PEN_TOUCH_TIMEOUT_MS`] of silence as its dead-client failsafe.
+    ///
     /// Requires the host to have advertised [`crate::quic::HOST_CAP_PEN`]; toward an older
     /// host this returns `Unsupported` (embedders keep their pen-as-touch fallback instead of
     /// spraying 240 Hz datagrams the host drops unread).