perf(latency): T1.1 frame-driven encode trigger + T1.4 time-based flush thresholds

design/latency-reduction-2026-07.md tier 1, remaining halves:

- T1.1: the native encode loop wakes on the capture's ACTUAL arrival instead of
  sampling at a free-running tick — deletes the sample-and-hold (~half a frame
  interval on average, a full one worst-case: ~8ms avg @60fps). New
  Capturer::supports_arrival_wait/wait_arrival pair (IDD-push waits its
  frame-ready event against the shared-header token; the PipeWire portal blocks
  its channel with a pending stash); backends without an arrival signal — and
  PUNKTFUNK_FRAME_DRIVEN=0 — keep the legacy tick bit-identically. A
  0.9x-interval rate floor caps encode at ~1.11x target when the compositor
  outruns the session; a +0.5x-interval keepalive keeps static desktops
  re-encoding at 1.5x-interval cadence. Pacing deadlines re-anchor to the
  actual submit so they can't drift against the arrival clock. GameStream
  plane untouched.
- T1.4: the jump-to-live detectors run on WALL-CLOCK now (STANDING_TIME /
  FLUSH_AFTER = 250ms) instead of 30-frame counts whose meaning scaled with
  fps (500ms @60 but 125ms @240 — and stretching further under T1.1's slower
  static-scene repeats). The queue trip also requires depth still >= high, so
  a hysteresis-band hover can't fire on elapsed time alone.

Validated: .21 Linux 185 core + 177 host + pf-capture tests, clippy
-D warnings; .133 Windows cargo check of pf-capture + punktfunk-host green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pf-capture/src/lib.rs

@@ -32,6 +32,22 @@ pub trait Capturer: Send {
         self.next_frame().map(Some)
     }
 
+    /// Whether this backend can block until a frame ARRIVES ([`wait_arrival`]
+    /// (Self::wait_arrival)) — the frame-driven encode trigger (latency plan T1.1). `false`
+    /// (the default) keeps the encode loop on its legacy fixed-cadence tick for this backend.
+    fn supports_arrival_wait(&self) -> bool {
+        false
+    }
+
+    /// Block until a FRESH frame is available via [`try_latest`](Self::try_latest) or
+    /// `deadline` passes — the encode loop's frame-driven wait (latency plan T1.1): waking on
+    /// the compositor's publish instead of sampling at a free-running tick deletes the
+    /// sample-and-hold (~half a frame interval on average). Must NOT consume the frame (the
+    /// loop's `try_latest` call does); backends buffer internally where the arrival channel
+    /// can't be peeked. Only called when [`supports_arrival_wait`](Self::supports_arrival_wait)
+    /// is `true`; errors surface at the following `try_latest`.
+    fn wait_arrival(&mut self, _deadline: std::time::Instant) {}
+
     /// Gate expensive per-frame work so the capturer can be kept alive (reused) between
     /// streams without burning CPU. The portal capturer skips the de-pad copy while inactive;
     /// the default is a no-op (synthetic sources are produced on demand). Set `true` for the