refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate

Second de-coupling for the host crate carve (plan §W6.1 leaf). config_dir /
create_private_dir / write_secret_file (+ the Windows DACL helpers) were pub(crate) in the
gamestream junk drawer, yet consumed by vdisplay, stats, gpu, library, mgmt_token,
native_pairing and the Windows service — many of which become pf-media / pf-vdisplay, for
which crate::gamestream would be an illegal upward edge. New leaf crate pf-paths (pure std
+ tracing) owns them; ~40 call sites across 14 files repoint to pf_paths::. gamestream
keeps only its own concerns.

Verified: Linux (home-worker-5) clippy -p pf-paths -p punktfunk-host --all-targets
-D warnings + tests (347 pass, incl. secrets_are_written_owner_only); Windows
(192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/pf-paths/Cargo.toml

@@ -0,0 +1,13 @@
+# Host config-dir + owner-private file helpers, extracted into a leaf crate so the subsystem crates
+# (pf-media, pf-vdisplay) and the orchestrator can share them without depending on the `gamestream`
+# module they used to live in (plan §W6). Pure std + tracing; no platform I/O stack.
+[package]
+name = "pf-paths"
+version = "0.12.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Host config-directory resolution + owner-private file/dir creation (0600/0700 or SYSTEM/Admins DACL)."
+publish = false
+
+[dependencies]
+tracing = "0.1"