feat(host+inject): pen P1 — per-session uinput virtual tablet, HOST_CAP_PEN live

The Linux injection leg of design/pen-tablet-input.md: 0xCC/0x05 pen batches now
route through the per-session PenTracker into a lazily-created 'Punktfunk Pen'
uinput tablet (BTN_TOOL_PEN/RUBBER, pressure, tilt-from-polar, ABS_Z barrel
roll, hover distance, INPUT_PROP_DIRECT) — compositors pick it up via libinput
and hand apps zwp_tablet_v2 with full fidelity. The host now advertises
HOST_CAP_PEN when /dev/uinput is accessible (PUNKTFUNK_PEN=0 kill-switch);
transitions group into SYN frames so proximity-enter carries its position.
Stroke failsafe: clients heartbeat ≤100ms while in range (documented wire
contract — capture APIs are silent for a stationary pen); 200ms of silence
force-releases. 'punktfunk-host pen-test' draws a pressure-ramped sine stroke
through the real tracker→uinput chain, no client needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/embedding-the-c-abi.md

@@ -466,8 +466,12 @@ punktfunk_connection_send_pen(c, &s, 1);
 ```
 
 While hovering, send `PUNKTFUNK_PEN_IN_RANGE` samples (with `distance` if you have it); when the
-pen leaves range, send one final sample with `state = 0` so the host releases proximity —
-though a host-side timeout releases a vanished client's stroke regardless.
+pen leaves range, send one final sample with `state = 0` so the host releases proximity.
+
+**Heartbeat**: while the pen is in range or touching, repeat the last sample at least every
+~100 ms even when nothing changed — pen capture APIs are silent for a stationary pen, and the
+host force-releases the stroke after 200 ms without samples (its dead-client failsafe). Run a
+timer alongside your touch callbacks.
 
 ---