Harden and package the Plasma desktop session

[55515-code]

Goal

Turn the live Plasma prototype into a reproducible package with a normal unprivileged desktop user and narrow host integration.

Acceptance criteria

• No unrestricted sudo or broad host /dev, /proc, /sys, or /run bind mounts.
• Full-screen handheld and HDMI behavior is deterministic.
• Built-in Deck controls and DualSense provide cursor, click, scroll, OSK, and exit mappings after reconnect.
• Logout and crashes return to EmulationStation through a supervisor.
• KDE applications are discoverable and privileged changes use reviewed brokers.

[55515-code]

Archived after the LuigiOS architecture transition merged in #11. The Batocera/Steam Deck/Plasma assumptions in this issue no longer describe the product on main. Current work targets the CachyOS/COSMIC developer workstation, transactional recovery, and rootless SDK. See #12 and the current roadmap for active contribution lanes. This issue remains public as historical context; it is not an active commitment.