rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/src/lib.rs

@@ -0,0 +1,49 @@
+//! # punktfunk-core
+//!
+//! The shared protocol / transport / FEC core for the punktfunk low-latency streaming
+//! stack. It is compiled exactly once and linked by every host and client — directly
+//! as a Rust `lib`, or across the [C ABI](crate::abi) by Swift / Kotlin / C clients.
+//!
+//! Everything platform-specific (capture, encode, decode, present, input injection)
+//! lives *outside* this crate. What lives *here*:
+//!
+//! - [`fec`] — erasure coding. GF(2⁸) for GameStream/Moonlight compatibility (P1) and
+//!   GF(2¹⁶) Leopard-RS (P2) which removes the ~1 Gbps per-frame shard-count ceiling.
+//! - [`packet`] — `#[repr(C)]` zero-copy wire framing: splitting an access unit into
+//!   FEC blocks of MTU-sized shards and reassembling them on the far side.
+//! - [`crypto`] — AES-128-GCM session sealing, matching GameStream in P1.
+//! - [`session`] — the host (submit frame → FEC → packetize → seal → send) and client
+//!   (recv → open → reorder → FEC recover → reassemble) state machines.
+//! - [`transport`] — pluggable packet I/O (in-process loopback for tests; UDP for real).
+//! - [`abi`] — the `extern "C"` surface and `cbindgen`-generated `punktfunk_core.h`.
+//!
+//! ## Threading contract
+//!
+//! Nothing in the per-frame path touches an async runtime. `tokio`/`quinn` are gated
+//! behind the off-by-default `quic` feature and used only for the control plane.
+
+#![forbid(unsafe_op_in_unsafe_fn)]
+
+pub mod abi;
+#[cfg(feature = "quic")]
+pub mod client;
+pub mod config;
+pub mod crypto;
+pub mod error;
+pub mod fec;
+pub mod input;
+pub mod packet;
+#[cfg(feature = "quic")]
+pub mod quic;
+pub mod session;
+pub mod stats;
+pub mod transport;
+
+pub use config::{Config, FecConfig, FecScheme, Mode, ProtocolPhase, Role};
+pub use error::{PunktfunkError, PunktfunkStatus, Result};
+pub use session::{Frame, Session};
+pub use stats::Stats;
+
+/// Bump on any breaking change to the [C ABI](crate::abi). Mirrors
+/// `punktfunk_abi_version()` and is checked by clients before use.
+pub const ABI_VERSION: u32 = 1;