feat(host): host-managed gamescope session at the client's mode (dynamic res + refresh)

Nested games on the Bazzite host saw the wrong display: refresh capped at 60 Hz,
the box's connected TV's EDID modes leaking in (DOOM landed on 2560×1440@60), and
the resolution fixed at whatever the always-on session was launched at — the
client's requested mode never reached the game. Root causes: the session-plus
gamescope command has no --nested-refresh (Xwayland advertises 59.96 Hz for every
mode), --prefer-output HDMI-A-1 makes gamescope read the TV EDID, and the ATTACH
model launches one fixed-resolution session.

New vdisplay path: PUNKTFUNK_GAMESCOPE_SESSION=<client> — the host LAUNCHES
gamescope-session-plus headless AT THE CLIENT'S mode and relaunches it when the
mode changes. Injected via a host-written GAMESCOPE_BIN wrapper (--nested-refresh
$PF_HZ, the flag session-plus doesn't expose) + DRM_MODE=cvt (gamescope generates
clean CVT modes at that refresh instead of the TV's EDID). The session runs as a
transient `systemd-run --user` unit (clean cgroup teardown of the Steam tree);
state lives in a host-lifetime static (MANAGED_SESSION), NOT in GamescopeDisplay
(which is per-client-session) — so a same-mode reconnect REUSES the running
session instantly (no Steam restart) while a different mode RELAUNCHES it (games
can't change output mode live; a game/Steam restart on a mode change is
unavoidable and acceptable). Reuses the existing node + EIS auto-discovery
(find_gamescope_node / find_gamescope_eis_socket, factored into
point_injector_at_eis) and the existing mid-stream Reconfigure → vd.create(mode)
machinery — no protocol or m3 control-flow change.

Validated live on bazzite (RTX 4090): games' Xwayland now advertises 5120×1440 @
239.90 Hz as the preferred mode (was 59.96), the TV's 3840×2160/4096×2160@60 modes
are gone, frames stream; reconnect at 1920×1080@120 relaunches and games see that;
same-mode reconnect reuses with no restart and frames flow instantly.

scripts: host.env.example documents PUNKTFUNK_GAMESCOPE_SESSION (mutually exclusive
with the legacy NODE=auto attach); punktfunk-steam-session.service marked
deprecated (superseded — must not run alongside the host-managed path).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/punktfunk-steam-session.service

@@ -1,10 +1,12 @@
 # punktfunk headless Steam session — systemd USER unit (Bazzite / SteamOS-like hosts).
 #
-# Runs the FULL gamescope-session-plus Steam Deck UI (MangoApp/VRR/controller config — all the
-# polish) headless, at your streaming client's resolution, with no physical display. punktfunk's
-# host then ATTACHES to it (capture its PipeWire node + inject into its libei socket) instead of
-# nesting a second, conflicting Steam — set the host's PUNKTFUNK_GAMESCOPE_NODE=auto +
-# PUNKTFUNK_INPUT_BACKEND=gamescope (see scripts/host.env.example).
+# DEPRECATED — superseded by the host-managed session (`PUNKTFUNK_GAMESCOPE_SESSION=steam` in
+# host.env). The host now LAUNCHES gamescope-session-plus on demand AT THE CLIENT'S mode (so games
+# see the client's exact resolution + refresh, dynamically per connection) and relaunches it on a
+# mode change. Do NOT enable this fixed-resolution unit alongside the host-managed path — two
+# gamescope sessions publish two Video/Source nodes and break node discovery. Kept only for the
+# legacy fixed-mode ATTACH setup (`PUNKTFUNK_GAMESCOPE_NODE=auto`); it caps every game at this
+# unit's resolution. The PREREQS below still apply to the host-managed path too.
 #
 # Prereq — free Steam from the local gaming session (so this owns it), on a headless box:
 #   sudo loginctl enable-linger $USER         # user services run without a graphical login