packaging: ship firewalld services on rpm + deb too, share from packaging/linux

Mirror the Arch firewalld service definitions into the RPM spec and the Debian
host package so every Linux packager installs them, and move the two XML files
to the shared packaging/linux/ home (alongside the .desktop files both the
PKGBUILD and deb scripts already source there) so there's one source of truth
instead of three drifting copies.

- rpm: install punktfunk-{gamestream,native}.xml to /usr/lib/firewalld/services/,
  list them in %files host, and print the firewalld enable command in %post
  (gated on firewall-cmd). Fedora/RHEL run firewalld by default, so this is where
  it matters most; Bazzite inherits it via the sysext built from the package /usr.
- deb: install both XMLs in build-deb.sh and add the same firewalld-gated hint to
  the postinst. Debian/Ubuntu ship no active firewall, so it's a no-op unless the
  admin runs firewalld.
- PKGBUILD + arch README updated to the packaging/linux/ path.
- Firewall docs (bazzite README now leads with --add-service; debian README gains
  a firewalld block) point at the shipped services; XML comments made
  distro-neutral. Never auto-enabled — packages don't touch the admin's firewall.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/bazzite/README.md

@@ -321,10 +321,23 @@ journalctl --user -u punktfunk-host -f
 
 ## 6. Firewall
 
-> ⚠️ **There is no firewall script or firewall doc in the repo.** The ports below are derived
-> directly from the code constants (`crates/punktfunk-host/src/gamestream/mod.rs`, `mgmt.rs`) and
-> the GameStream-host port-map (`design/gamestream-host-plan.md`). Treat the `firewall-cmd` lines as recommended-but-verified,
-> not a checked-in script.
+Bazzite runs **firewalld**, so the ports must be opened. The `punktfunk-host` package installs
+firewalld **service definitions** (`/usr/lib/firewalld/services/punktfunk-gamestream.xml` and
+`punktfunk-native.xml`), so enabling is one command — reload first so firewalld picks up the
+definition, add the service, reload to apply:
+
+```sh
+sudo firewall-cmd --reload
+sudo firewall-cmd --permanent --add-service=punktfunk-gamestream   # Moonlight/GameStream host
+#                              --add-service=punktfunk-native       # …or the native-only host
+sudo firewall-cmd --reload
+```
+
+`punktfunk-gamestream` opens the fixed Moonlight ports + mDNS; `punktfunk-native` opens the QUIC
+control port (UDP 9777) + mDNS. Enable both if the host runs `serve --gamestream` (both planes). The
+per-port breakdown below is for reference (or for opening ports by hand); the ports are the code
+constants (`crates/punktfunk-host/src/gamestream/mod.rs`, `mgmt.rs`) and the GameStream-host port-map
+(`design/gamestream-host-plan.md`).
 
 **GameStream / Moonlight ports** (fixed; Moonlight derives them from the HTTP base). These only apply
 when the host runs `serve --gamestream` (the bundled unit's default); on a bare-`serve` native-only
@@ -344,7 +357,7 @@ host you don't open them:
 default**, so you do **not** open it in the firewall unless you deliberately move it off loopback
 with `--mgmt-bind IP:PORT` (which also requires `--mgmt-token`). Leave it closed for a normal setup.
 
-Open the GameStream ports with `firewalld` (Bazzite uses firewalld):
+To open the GameStream ports by hand instead of the service (equivalent):
 
 ```sh
 sudo firewall-cmd --permanent --add-port=47984/tcp \