feat(nixpak): sandbox umu-launcher with ~/Gaming as its home (#519)

* feat(nixpak): sandbox umu-launcher with ~/Games as its home

umu-run, winetricks and bbe leave the host PATH, so umu launchers
generated before this stop working until rewritten with
`umu-install.nu <name> - <launcher> <gameid>`.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* refactor(nixpak): mount ~/Gaming as the game sandbox home

idols-ai now preserves ~/Gaming instead of ~/Games, so existing games
vanish from the host after deploy until the preserved ~/Games is moved
to ~/Gaming/Games.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* docs(nixpak): record umu runtime validation

Assisted-by: Claude Agent SDK (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)

modules/nixos/desktop/gaming.nix

@@ -56,7 +56,8 @@ in
     # Expose DW-Proton to umu-run: umu ignores Steam's
     # STEAM_EXTRA_COMPAT_TOOLS_PATHS, and a store path baked into a generated
     # launcher goes stale on every dwproton-bin update. The nix-config-umu-game
-    # skill and the run/exec scripts it generates read this first.
+    # installer reads this on the host; the umu sandbox
+    # (hardening/nixpaks/umu.nix) sets the same path for the run/exec scripts.
     environment.variables.UMU_PROTONPATH = "${pkgs.dwproton-bin.steamcompattool}";
 
     # GameScope: run a game in its own nested compositor and let it renice