feat(host/steam): shippable usbip/vhci_hcd virtual Deck + client leave-shortcuts

Steam Deck pass-through (design/steam-deck-passthrough-plan.md), code-complete +
all CI checks green on Linux + adversarially reviewed; on-glass validation pending:

- usbip/`vhci_hcd` virtual Deck transport (inject/linux/steam_usbip.rs) for
  non-SteamOS hosts (Bazzite/generic) — presents a real interface-2 USB Deck so
  Steam Input promotes it. In-process vhci attach (loopback OP_REQ_IMPORT handshake
  → sysfs attach) with a bounded `usbip`-CLI fallback; detach on drop.
- Backed by a vendored, libusb-free trim of the `usbip` crate
  (crates/punktfunk-host/vendor/usbip-sim, MIT + NOTICE; host/cdc/hid + rusb/nusb
  removed; interrupt-IN paced by bInterval).
- Selection ladder raw_gadget (SteamOS fast-path) → usbip (universal) → UHID,
  with PUNKTFUNK_STEAM_USBIP / PUNKTFUNK_USBIP_ATTACH knobs.
- Shared Deck descriptors + the 0x83/0xAE feature contract + a Steam-accepted
  serial consolidated into steam_proto.rs; the raw_gadget backend reuses them.
- Linux client leave-shortcuts: Ctrl+Alt+Shift+D + holding the escape chord
  (L1+R1+Start+Select) >=1.5s end the session (short press still exits
  fullscreen); the chord state resets across sessions.

Also bundles in-progress work already staged in the tree:
- host(kwin): xdg-output logical-geometry mapping so the KWin fake_input backend
  places absolute coordinates correctly under display scaling.
- docs: design/README index entries + design/controller-only-mode.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/inject/linux/steam_controller.rs

@@ -240,11 +240,13 @@ impl Drop for SteamDeckPad {
 /// [`apply_rich`](Self::apply_rich); [`pump`](Self::pump) services the kernel handshake + routes
 /// rumble back; [`heartbeat`](Self::heartbeat) keeps the pad alive (and drives the mode-entry pulse).
 /// The transport a manager pad drives. UHID is universal but Steam Input won't promote it (a UHID
-/// device has no USB interface number); the USB gadget is SteamOS-only but Steam Input *does* promote
-/// it (it presents the controller on interface 2). Selected per-pad in [`SteamControllerManager::ensure`].
+/// device has no USB interface number, `Interface: -1`); the USB **gadget** (`raw_gadget`, SteamOS)
+/// and **usbip** (`vhci_hcd`, universal) both present the controller on USB interface 2, which Steam
+/// Input *does* promote. Selected per-pad by [`open_transport`].
 enum DeckTransport {
     Uhid(SteamDeckPad),
     Gadget(crate::inject::steam_gadget::SteamDeckGadget),
+    Usbip(crate::inject::steam_usbip::SteamDeckUsbip),
 }
 
 impl DeckTransport {
@@ -254,22 +256,67 @@ impl DeckTransport {
                 let _ = p.write_state(st);
             }
             DeckTransport::Gadget(g) => g.write_state(st),
+            DeckTransport::Usbip(u) => u.write_state(st),
         }
     }
     fn service(&mut self) -> Option<(u16, u16)> {
         match self {
             DeckTransport::Uhid(p) => p.service(),
             DeckTransport::Gadget(g) => g.service().rumble,
+            DeckTransport::Usbip(u) => u.service().rumble,
         }
     }
     fn in_mode_entry(&self) -> bool {
         match self {
+            // Only the UHID pad needs the gamepad-mode entry pulse: the promoted transports are
+            // read raw via hidraw by Steam Input, which bypasses the kernel's evdev mode gate.
             DeckTransport::Uhid(p) => p.in_mode_entry(),
-            DeckTransport::Gadget(_) => false,
+            DeckTransport::Gadget(_) | DeckTransport::Usbip(_) => false,
         }
     }
 }
 
+/// Open the best Steam-Input-promotable Deck transport available, in preference order:
+/// **`raw_gadget` (SteamOS validated fast-path) → `usbip`/`vhci_hcd` (universal, Secure-Boot-clean)
+/// → UHID (universal, but `Interface: -1` so Steam Input won't promote it).** Each rung degrades to
+/// the next on failure, so a host lacking the gadget modules still gets a *promotable* Deck via
+/// usbip, and one lacking both still gets a working (if non-promoted) UHID pad.
+fn open_transport(idx: u8) -> Result<DeckTransport> {
+    use crate::inject::{steam_gadget, steam_usbip};
+    // 1. raw_gadget — the validated SteamOS fast-path (default on there).
+    if steam_gadget::gadget_preferred() {
+        steam_gadget::ensure_modules();
+        match steam_gadget::SteamDeckGadget::open(idx) {
+            Ok(g) => {
+                tracing::info!(
+                    index = idx,
+                    "virtual Steam Deck created (USB gadget — Steam Input recognizes it)"
+                );
+                return Ok(DeckTransport::Gadget(g));
+            }
+            Err(e) => {
+                tracing::warn!(error = %format!("{e:#}"), "USB-gadget Deck unavailable — trying usbip")
+            }
+        }
+    }
+    // 2. usbip/vhci_hcd — the universal, in-tree, Secure-Boot-clean transport (default on elsewhere).
+    if steam_usbip::usbip_preferred() {
+        match steam_usbip::SteamDeckUsbip::open(idx) {
+            Ok(u) => return Ok(DeckTransport::Usbip(u)),
+            Err(e) => {
+                tracing::warn!(error = %format!("{e:#}"), "usbip Deck unavailable — falling back to UHID")
+            }
+        }
+    }
+    // 3. UHID — universal fallback (works everywhere; Steam Input won't promote it).
+    let p = SteamDeckPad::open(idx)?;
+    tracing::info!(
+        index = idx,
+        "virtual Steam Deck created (UHID hid-steam — not Steam-Input-promoted)"
+    );
+    Ok(DeckTransport::Uhid(p))
+}
+
 pub struct SteamControllerManager {
     pads: Vec<Option<DeckTransport>>,
     state: Vec<SteamState>,
@@ -384,31 +431,8 @@ impl SteamControllerManager {
         if idx >= MAX_PADS || self.pads[idx].is_some() || self.broken {
             return;
         }
-        // Prefer the USB gadget on SteamOS (default there — the only transport Steam Input promotes);
-        // fall back to the universal UHID pad if the gadget is unavailable or disabled.
-        let opened = if crate::inject::steam_gadget::gadget_preferred() {
-            crate::inject::steam_gadget::ensure_modules();
-            match crate::inject::steam_gadget::SteamDeckGadget::open(idx as u8) {
-                Ok(g) => {
-                    tracing::info!(
-                        index = idx,
-                        "virtual Steam Deck created (USB gadget — Steam Input recognizes it)"
-                    );
-                    Ok(DeckTransport::Gadget(g))
-                }
-                Err(e) => {
-                    tracing::warn!(error = %format!("{e:#}"), "USB-gadget Deck unavailable — falling back to UHID");
-                    SteamDeckPad::open(idx as u8).map(DeckTransport::Uhid)
-                }
-            }
-        } else {
-            SteamDeckPad::open(idx as u8).map(DeckTransport::Uhid)
-        };
-        match opened {
+        match open_transport(idx as u8) {
             Ok(t) => {
-                if matches!(t, DeckTransport::Uhid(_)) {
-                    tracing::info!(index = idx, "virtual Steam Deck created (UHID hid-steam)");
-                }
                 self.pads[idx] = Some(t);
                 self.state[idx] = SteamState::neutral();
                 self.last_rumble[idx] = (0, 0);