feat(packaging): ship punktfunk everywhere, and deprecate the session's stray pairing flag

The rest of C1. A CLI that only exists in a dev tree is not a door anyone can use, so it
now builds and installs in deb, rpm, arch, nix, flatpak and MSIX alongside the client and
the session. On Windows it gets its own `AppListEntry="none"` application with the alias
`punktfunk.exe` — a command, not a Start-menu tile — which is what the Playnite importer
will shell to for `punktfunk library <host> --json`.

`punktfunk-session --pair` prints a deprecation notice and forwards. Pairing is a trust
ceremony and belongs to the brain, fronted by `punktfunk pair` or a shell; a renderer
owning one is precisely the mixing of concerns this split exists to undo. It keeps working
for a release, because someone's provisioning script is calling it today.

Decky's invocations are untouched and verified still working (`--list-hosts` JSON shape
unchanged, `--reachable` exit codes unchanged): those flags are a frozen compat contract
until Decky migrates to the verbs at its own pace.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

clients/session/src/main.rs

@@ -400,10 +400,16 @@ mod session_main {
             };
         }
 
-        // `--pair <PIN>`: enrol this machine against a host and exit. Sits with the other
-        // non-streaming subcommands, above every graphics call — the box doing this may have
-        // no display at all.
+        // `--pair <PIN>`: enrol this machine against a host and exit. DEPRECATED — pairing is
+        // a trust ceremony and belongs to the brain, fronted by `punktfunk pair` or a shell
+        // (design/client-architecture-split.md §5). It still works, with a notice, for the one
+        // release this needs; a renderer owning a trust ceremony is exactly the mixing of
+        // concerns the split exists to undo.
         if let Some(pin) = arg_value("--pair") {
+            eprintln!(
+                "note: punktfunk-session --pair is deprecated \u{2014} use `punktfunk pair \
+                 <host[:port]>` instead (same store, same result)."
+            );
             return headless_pair(&pin);
         }