build(linux): enable --features nvenc in the arch/deb/rpm host builds

The Phase 5.2 direct-SDK NVENC Linux backend (encode/linux/nvenc_cuda.rs) is
gated `#[cfg(all(target_os = "linux", feature = "nvenc"))]`, but no Linux
packager passed `--features nvenc` (it was historically a Windows-only feature
for the D3D11 NVENC path). So the module was compiled OUT of every arch/deb/rpm
canary regardless of commit — PUNKTFUNK_NVENC_DIRECT was a silent no-op on the
shipped Linux host. Add `--features punktfunk-host/nvenc` to all three package
builds so the code actually ships.

AMD/Intel-SAFE (verified): this is NOT the old Windows link-import crash. The
NVENC/CUDA entry points are dlopen'd at RUNTIME (libloading) — `objdump -p` shows
the feature build's DT_NEEDED is byte-identical to a plain build (no libcuda /
libnvidia-encode), so the binary starts fine driver-less. We use only the crate's
`sys::nvEncodeAPI` types (no code-running safe wrapper / lazy statics), cudarc
stays on `ci-check`/dynamic-loading (no CUDA toolkit at build), and the encoder is
only constructed for a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT — never on a
VAAPI (AMD/Intel) host. The sysext images repackage these outputs, so they inherit
it; no other Linux host build compiles the binary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/deb.yml

@@ -90,7 +90,11 @@ jobs:
           git config --global --add safe.directory "$PWD"
           # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect —
           # both client binaries must ship (build-client-deb.sh installs both).
-          cargo build --release --locked \
+          # --features punktfunk-host/nvenc: the direct-SDK NVENC path (real RFI + recovery anchor on
+          # Linux NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-safe — NVENC/CUDA is dlopen'd at
+          # runtime (no link-time dep; identical DT_NEEDED to a plain build), and the encoder is only
+          # constructed for a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT, never on VAAPI hosts.
+          cargo build --release --locked --features punktfunk-host/nvenc \
             -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session
 
       - name: Build + smoke-boot web console (bun preset)

packaging/arch/PKGBUILD

@@ -67,7 +67,12 @@ build() {
   # caveat the RPM documents): ln -s "$(find / -name libcuda.so -path '*stubs*'|head -1)" /usr/lib/
   # punktfunk-client-session is the Vulkan/Skia streamer the shell (punktfunk-client) execs for
   # a connect — both binaries must ship or streaming from the desktop client breaks.
-  cargo build --release --locked \
+  # `--features punktfunk-host/nvenc` compiles in the direct-SDK NVENC path (real RFI + recovery
+  # anchor on Linux NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-SAFE: the NVENC/CUDA entry
+  # points are dlopen'd at RUNTIME (libloading), never link-imported — `objdump -p` shows the same
+  # DT_NEEDED as a plain build (no libcuda/libnvidia-encode), so the binary starts fine driver-less
+  # and only touches NVIDIA when a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT actually select it.
+  cargo build --release --locked --features punktfunk-host/nvenc \
     -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray
   # Management web console (opt-in): the Nitro `bun`-preset .output bundle (Bun.serve TLS),
   # built AND run with bun.

packaging/rpm/punktfunk.spec

@@ -175,7 +175,11 @@ export PUNKTFUNK_BUILD_VERSION="%{version}-%{release}"
 # --locked: reproducible from (commit + Cargo.lock), matching the .deb build path.
 # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect — both
 # client binaries must ship or streaming from the desktop client breaks.
-cargo build --release --locked \
+# --features punktfunk-host/nvenc: the direct-SDK NVENC path (real RFI + recovery anchor on Linux
+# NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-safe — the NVENC/CUDA entry points are dlopen'd
+# at runtime (no link-time dep; __requires_exclude already drops libcuda), so the binary starts
+# driver-less; the encoder is only built for a CUDA frame + PUNKTFUNK_NVENC_DIRECT, never on VAAPI.
+cargo build --release --locked --features punktfunk-host/nvenc \
   -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray
 
 %if %{with web}