rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/Tests/PunktfunkKitTests/AnnexBTests.swift

@@ -2,7 +2,7 @@
 // VideoToolboxRoundTripTests covers the real-bitstream path).
 
 import XCTest
-@testable import LumenKit
+@testable import PunktfunkKit
 
 final class AnnexBTests: XCTestCase {
     /// NAL with the given HEVC type in bits 1..6 of the first header byte.

clients/apple/Tests/PunktfunkKitTests/LoopbackIntegrationTests.swift

@@ -1,20 +1,20 @@
-// Integration: the Swift wrapper against a real lumen/1 host over QUIC + UDP on loopback —
-// the Swift twin of lumen-host's m3.rs::c_abi_connection_roundtrip, this time through the
+// Integration: the Swift wrapper against a real punktfunk/1 host over QUIC + UDP on loopback —
+// the Swift twin of punktfunk-host's m3.rs::c_abi_connection_roundtrip, this time through the
 // statically linked xcframework. Driven by clients/apple/test-loopback.sh, which builds and
-// starts `lumen-host m3-host --source synthetic` and sets LUMEN_LOOPBACK_PORT.
+// starts `punktfunk-host m3-host --source synthetic` and sets PUNKTFUNK_LOOPBACK_PORT.
 
 import XCTest
-@testable import LumenKit
+@testable import PunktfunkKit
 
 final class LoopbackIntegrationTests: XCTestCase {
     func testSyntheticStreamRoundTrip() throws {
-        guard let portStr = ProcessInfo.processInfo.environment["LUMEN_LOOPBACK_PORT"],
+        guard let portStr = ProcessInfo.processInfo.environment["PUNKTFUNK_LOOPBACK_PORT"],
               let port = UInt16(portStr)
         else {
             throw XCTSkip("needs a running m3-host — use clients/apple/test-loopback.sh")
         }
 
-        let conn = try LumenConnection(
+        let conn = try PunktfunkConnection(
             host: "127.0.0.1", port: port, width: 1280, height: 720, refreshHz: 60)
         XCTAssertEqual(conn.width, 1280)
         XCTAssertEqual(conn.height, 720)
@@ -49,7 +49,7 @@ final class LoopbackIntegrationTests: XCTestCase {
 
         conn.close()
         XCTAssertThrowsError(try conn.nextAU(timeoutMs: 10)) { error in
-            guard case LumenClientError.closed = error else {
+            guard case PunktfunkClientError.closed = error else {
                 return XCTFail("expected .closed, got \(error)")
             }
         }
@@ -58,7 +58,7 @@ final class LoopbackIntegrationTests: XCTestCase {
     func testConnectFailureThrows() {
         // Nothing listens on this port; connect must fail within its timeout, not hang.
         XCTAssertThrowsError(
-            try LumenConnection(
+            try PunktfunkConnection(
                 host: "127.0.0.1", port: 9, width: 640, height: 480, refreshHz: 30,
                 timeoutMs: 2000))
     }

clients/apple/Tests/PunktfunkKitTests/RemoteFirstLightTests.swift

@@ -4,25 +4,25 @@
 // putting the layer on glass.
 //
 // Run (host side, on the Linux box):
-//   LUMEN_COMPOSITOR=gamescope LUMEN_GAMESCOPE_APP=vkcube LUMEN_ZEROCOPY=1 \
-//   lumen-host m3-host --source virtual --seconds 120
+//   PUNKTFUNK_COMPOSITOR=gamescope PUNKTFUNK_GAMESCOPE_APP=vkcube PUNKTFUNK_ZEROCOPY=1 \
+//   punktfunk-host m3-host --source virtual --seconds 120
 // Then here:
-//   LUMEN_REMOTE_HOST=192.168.1.70 swift test --filter RemoteFirstLightTests
+//   PUNKTFUNK_REMOTE_HOST=192.168.1.70 swift test --filter RemoteFirstLightTests
 
 import CoreMedia
 import VideoToolbox
 import XCTest
-@testable import LumenKit
+@testable import PunktfunkKit
 
 final class RemoteFirstLightTests: XCTestCase {
     func testRemoteStreamDecodesToPixels() throws {
-        guard let host = ProcessInfo.processInfo.environment["LUMEN_REMOTE_HOST"] else {
-            throw XCTSkip("set LUMEN_REMOTE_HOST (and start m3-host --source virtual there)")
+        guard let host = ProcessInfo.processInfo.environment["PUNKTFUNK_REMOTE_HOST"] else {
+            throw XCTSkip("set PUNKTFUNK_REMOTE_HOST (and start m3-host --source virtual there)")
         }
         let width: UInt32 = 1280
         let height: UInt32 = 720
 
-        let conn = try LumenConnection(
+        let conn = try PunktfunkConnection(
             host: host, width: width, height: height, refreshHz: 60)
         defer { conn.close() }
         XCTAssertEqual(conn.width, width)

clients/apple/Tests/PunktfunkKitTests/VideoToolboxRoundTripTests.swift

@@ -1,13 +1,13 @@
 // Real-bitstream proof of the decode-prep path: VTCompressionSession encodes HEVC, we
 // rebuild the host's wire shape (Annex-B AU with in-band VPS/SPS/PPS — exactly what
-// lumen-host emits on every IDR), run it through AnnexB, and hand the result to a real
+// punktfunk-host emits on every IDR), run it through AnnexB, and hand the result to a real
 // VTDecompressionSession. Pixels out = the whole client decode path is sound.
 
 import AVFoundation
 import CoreMedia
 import VideoToolbox
 import XCTest
-@testable import LumenKit
+@testable import PunktfunkKit
 
 final class VideoToolboxRoundTripTests: XCTestCase {
     private let width = 320