rename: lumen → punktfunk, everywhere

Full project rename, decided 2026-06-10:
- Crates/binaries: punktfunk-core / punktfunk-host / punktfunk-client-rs.
- C ABI: punktfunk_* symbols, Punktfunk* types, include/punktfunk_core.h,
  PUNKTFUNK_FEATURE_QUIC guard (header regenerated; cbindgen renames updated, incl.
  PUNKTFUNK_BTN_*/PUNKTFUNK_AXIS_* wire constants).
- Protocol: punktfunk/1 — control-plane magic LMN1 → PKF1, nonce salt lmn1 → pkf1.
  WIRE BREAK: clients must be rebuilt from this revision.
- Env knobs: PUNKTFUNK_VIDEO_SOURCE / PUNKTFUNK_COMPOSITOR / PUNKTFUNK_ZEROCOPY / ….
- Host config dir: ~/.config/punktfunk (the box's dir was migrated in place — the
  persistent identity is unchanged, pinned fingerprints stay valid).
- Swift package: PunktfunkKit + PunktfunkCore.xcframework + PunktfunkConnection
  (Sources/PunktfunkClient app + tests renamed with it); build-xcframework.sh updated.
- scripts/: 60-punktfunk.rules, punktfunk-host.service; OpenAPI doc regenerated.

Also: scripts/headless/run-headless-kde.sh — full headless Plasma bringup. Root cause of
"desktop but no apps/settings" over the stream: plasmashell launched without
XDG_MENU_PREFIX=plasma-, so the launcher resolved a nonexistent applications.menu and
rendered an empty menu. The script sets the complete KDE session env (menu prefix,
KDE_FULL_SESSION, session version) and rebuilds ksycoca before starting plasmashell.

Gate: 97/97 tests, clippy -D warnings (both feature sets), fmt, C-ABI harness PASS,
zero lumen references left outside .git.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/pipeline.rs

@@ -0,0 +1,39 @@
+//! The host hot path (plan §7), wiring the platform stages to `punktfunk_core`:
+//!
+//! ```text
+//! capture(dmabuf) → encode(NVENC/VAAPI) → core[FEC+packetize+pace+send]
+//! ```
+//!
+//! Each stage runs on its own native OS thread, connected by bounded SPSC channels with
+//! drop-oldest on overflow so the encoder is never blocked. No async runtime here.
+
+use crate::capture::Capturer;
+use crate::encode::{EncodedFrame, Encoder};
+use anyhow::Result;
+use punktfunk_core::packet::{FLAG_PIC, FLAG_SOF};
+use punktfunk_core::Session;
+
+/// Drive one capture→encode→submit step. The real pipeline spawns threads and uses
+/// bounded channels; this documents the data flow and the `punktfunk_core` submit contract.
+pub fn pump_once(
+    capturer: &mut dyn Capturer,
+    encoder: &mut dyn Encoder,
+    session: &mut Session,
+) -> Result<()> {
+    let frame = capturer.next_frame()?;
+    encoder.submit(&frame)?;
+    while let Some(EncodedFrame {
+        data,
+        pts_ns,
+        keyframe,
+    }) = encoder.poll()?
+    {
+        let mut flags = FLAG_PIC as u32;
+        if keyframe {
+            flags |= FLAG_SOF as u32;
+        }
+        // core does FEC + packetize + pace + send.
+        session.submit_frame(&data, pts_ns, flags)?;
+    }
+    Ok(())
+}