feat(host): host-managed gamescope session at the client's mode (dynamic res + refresh)

Nested games on the Bazzite host saw the wrong display: refresh capped at 60 Hz,
the box's connected TV's EDID modes leaking in (DOOM landed on 2560×1440@60), and
the resolution fixed at whatever the always-on session was launched at — the
client's requested mode never reached the game. Root causes: the session-plus
gamescope command has no --nested-refresh (Xwayland advertises 59.96 Hz for every
mode), --prefer-output HDMI-A-1 makes gamescope read the TV EDID, and the ATTACH
model launches one fixed-resolution session.

New vdisplay path: PUNKTFUNK_GAMESCOPE_SESSION=<client> — the host LAUNCHES
gamescope-session-plus headless AT THE CLIENT'S mode and relaunches it when the
mode changes. Injected via a host-written GAMESCOPE_BIN wrapper (--nested-refresh
$PF_HZ, the flag session-plus doesn't expose) + DRM_MODE=cvt (gamescope generates
clean CVT modes at that refresh instead of the TV's EDID). The session runs as a
transient `systemd-run --user` unit (clean cgroup teardown of the Steam tree);
state lives in a host-lifetime static (MANAGED_SESSION), NOT in GamescopeDisplay
(which is per-client-session) — so a same-mode reconnect REUSES the running
session instantly (no Steam restart) while a different mode RELAUNCHES it (games
can't change output mode live; a game/Steam restart on a mode change is
unavoidable and acceptable). Reuses the existing node + EIS auto-discovery
(find_gamescope_node / find_gamescope_eis_socket, factored into
point_injector_at_eis) and the existing mid-stream Reconfigure → vd.create(mode)
machinery — no protocol or m3 control-flow change.

Validated live on bazzite (RTX 4090): games' Xwayland now advertises 5120×1440 @
239.90 Hz as the preferred mode (was 59.96), the TV's 3840×2160/4096×2160@60 modes
are gone, frames stream; reconnect at 1920×1080@120 relaunches and games see that;
same-mode reconnect reuses with no restart and frames flow instantly.

scripts: host.env.example documents PUNKTFUNK_GAMESCOPE_SESSION (mutually exclusive
with the legacy NODE=auto attach); punktfunk-steam-session.service marked
deprecated (superseded — must not run alongside the host-managed path).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/host.env.example

@@ -13,9 +13,20 @@ PUNKTFUNK_VIDEO_SOURCE=virtual
 # GPU zero-copy capture (EGL/Vulkan → CUDA → NVENC). Falls back to CPU automatically.
 PUNKTFUNK_ZEROCOPY=1
 
+# --- Bazzite / SteamOS-like host: host-managed Steam-Deck-UI session -----------------------
+# The host LAUNCHES gamescope-session-plus headless AT THE CLIENT'S mode (so games see the
+# client's exact resolution + refresh, not the box's TV), and relaunches it when the mode
+# changes. Requires the headless-appliance prereqs (linger + multi-user.target — see
+# punktfunk-steam-session.service header) and NO physical gaming session running.
+#PUNKTFUNK_COMPOSITOR=gamescope
+#PUNKTFUNK_GAMESCOPE_SESSION=steam   # host owns a gamescope-session-plus session at the client mode
+#PUNKTFUNK_INPUT_BACKEND=gamescope
+# Mutually exclusive with the above: ATTACH to a gamescope session something ELSE owns (fixed mode):
+#PUNKTFUNK_GAMESCOPE_NODE=auto       # discover + capture a running gamescope (do NOT combine with SESSION)
+
 # Optional overrides (apps.json is the primary mechanism for per-app settings):
 #PUNKTFUNK_COMPOSITOR=kwin          # kwin | mutter | gamescope | wlroots
-#PUNKTFUNK_GAMESCOPE_APP=vkcube     # nested command for ad-hoc gamescope sessions
+#PUNKTFUNK_GAMESCOPE_APP=vkcube     # nested command for ad-hoc bare-gamescope sessions
 #PUNKTFUNK_INPUT_BACKEND=libei      # wlr | libei | gamescope | uinput
 #PUNKTFUNK_FEC_PCT=20               # video FEC overhead percent
 #PUNKTFUNK_PERF=1                   # per-stage timing logs

scripts/punktfunk-steam-session.service

@@ -1,10 +1,12 @@
 # punktfunk headless Steam session — systemd USER unit (Bazzite / SteamOS-like hosts).
 #
-# Runs the FULL gamescope-session-plus Steam Deck UI (MangoApp/VRR/controller config — all the
-# polish) headless, at your streaming client's resolution, with no physical display. punktfunk's
-# host then ATTACHES to it (capture its PipeWire node + inject into its libei socket) instead of
-# nesting a second, conflicting Steam — set the host's PUNKTFUNK_GAMESCOPE_NODE=auto +
-# PUNKTFUNK_INPUT_BACKEND=gamescope (see scripts/host.env.example).
+# DEPRECATED — superseded by the host-managed session (`PUNKTFUNK_GAMESCOPE_SESSION=steam` in
+# host.env). The host now LAUNCHES gamescope-session-plus on demand AT THE CLIENT'S mode (so games
+# see the client's exact resolution + refresh, dynamically per connection) and relaunches it on a
+# mode change. Do NOT enable this fixed-resolution unit alongside the host-managed path — two
+# gamescope sessions publish two Video/Source nodes and break node discovery. Kept only for the
+# legacy fixed-mode ATTACH setup (`PUNKTFUNK_GAMESCOPE_NODE=auto`); it caps every game at this
+# unit's resolution. The PREREQS below still apply to the host-managed path too.
 #
 # Prereq — free Steam from the local gaming session (so this owns it), on a headless box:
 #   sudo loginctl enable-linger $USER         # user services run without a graphical login