rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/apple/Tests/PunktfunkKitTests/LoopbackIntegrationTests.swift

@@ -0,0 +1,65 @@
+// Integration: the Swift wrapper against a real punktfunk/1 host over QUIC + UDP on loopback —
+// the Swift twin of punktfunk-host's m3.rs::c_abi_connection_roundtrip, this time through the
+// statically linked xcframework. Driven by clients/apple/test-loopback.sh, which builds and
+// starts `punktfunk-host m3-host --source synthetic` and sets PUNKTFUNK_LOOPBACK_PORT.
+
+import XCTest
+@testable import PunktfunkKit
+
+final class LoopbackIntegrationTests: XCTestCase {
+    func testSyntheticStreamRoundTrip() throws {
+        guard let portStr = ProcessInfo.processInfo.environment["PUNKTFUNK_LOOPBACK_PORT"],
+              let port = UInt16(portStr)
+        else {
+            throw XCTSkip("needs a running m3-host — use clients/apple/test-loopback.sh")
+        }
+
+        let conn = try PunktfunkConnection(
+            host: "127.0.0.1", port: port, width: 1280, height: 720, refreshHz: 60)
+        XCTAssertEqual(conn.width, 1280)
+        XCTAssertEqual(conn.height, 720)
+        XCTAssertEqual(conn.refreshHz, 60)
+
+        // Pull 25 synthetic frames and byte-verify the documented pattern:
+        // u32 LE frame index, then data[i] = (idx as u8) &+ (i as u8).
+        var got = 0
+        var lastIndex: UInt32 = 0
+        let deadline = Date().addingTimeInterval(30)
+        while got < 25 {
+            XCTAssertLessThan(Date(), deadline, "timed out after \(got) frames")
+            guard let au = try conn.nextAU(timeoutMs: 2000) else { continue }
+            let idx = au.data.prefix(4).reversed().reduce(UInt32(0)) { ($0 << 8) | UInt32($1) }
+            for (i, byte) in au.data.enumerated().dropFirst(4) {
+                let expected = UInt8(truncatingIfNeeded: idx) &+ UInt8(truncatingIfNeeded: i)
+                if byte != expected {
+                    XCTFail("frame \(idx) corrupt at offset \(i)")
+                    break
+                }
+            }
+            XCTAssertGreaterThan(au.ptsNs, 0)
+            lastIndex = idx
+            got += 1
+        }
+        XCTAssertGreaterThanOrEqual(lastIndex, 24)
+
+        // Input goes the other way (enqueue-only; the host logs the count on close).
+        conn.send(.mouseMove(dx: 1, dy: 2))
+        conn.send(.key(0x41, down: true))
+        conn.send(.key(0x41, down: false))
+
+        conn.close()
+        XCTAssertThrowsError(try conn.nextAU(timeoutMs: 10)) { error in
+            guard case PunktfunkClientError.closed = error else {
+                return XCTFail("expected .closed, got \(error)")
+            }
+        }
+    }
+
+    func testConnectFailureThrows() {
+        // Nothing listens on this port; connect must fail within its timeout, not hang.
+        XCTAssertThrowsError(
+            try PunktfunkConnection(
+                host: "127.0.0.1", port: 9, width: 640, height: 480, refreshHz: 30,
+                timeoutMs: 2000))
+    }
+}