feat(nixpak): sandbox Steam and Heroic in ~/Gaming (#520)

* feat(nixpak): sandbox Steam and Heroic in ~/Gaming

idols-ai stops preserving ~/.local/share/Steam, ~/.steam, ~/.config/heroic
and their game data, which must be moved into ~/Gaming before deploying.

Assisted-by: DeepSeek Harness (deepseek-flash)

* refactor(nixpak): replace steam-fix.nu with sandboxed protontricks

Assisted-by: DeepSeek Harness (claude-opus-5-5)

* fix(nixpak): hide host documents and GTK config from game sandboxes

Assisted-by: DeepSeek Harness (claude-opus-5-5)

* docs(ai): locate the Steam library under ~/Gaming

Assisted-by: DeepSeek Harness (claude-opus-5-5)

* fix(umu-game): confine writes to ~/Gaming and keep foreign entries

Assisted-by: DeepSeek Harness (claude-opus-5-5)

* fix(nixpak): keep Steam and Heroic in the application launcher

The wrappers only carried bin/, so neither launcher had a desktop entry
after replacing programs.steam.

Assisted-by: DeepSeek Harness (deepseek-flash)

* fix(nixpak): give the game sandboxes a fontconfig that sees CJK fonts

Steam rendered Chinese as tofu: the FHS layers build their own /etc/fonts,
whose config lists only DejaVu and the XDG font directory, so neither the
host fonts nor the FHS /usr/share/fonts were ever scanned. Point
FONTCONFIG_FILE at a small config that includes /usr/share/fonts, and ship
WenQuanYi Zen Hei and Noto Sans CJK in all three FHS layers.

Assisted-by: DeepSeek Harness (deepseek-flash)

* fix(nixpak): grant the game launchers a StatusNotifier tray icon

Steam and Heroic register a tray icon over D-Bus, and the game sandboxes
granted no StatusNotifierWatcher access, so the desktop shell had nothing
to show for them. Enable desktopIntegration.tray for all three launchers
and teach the policy suites to expect it.

Assisted-by: DeepSeek Harness (deepseek-flash)

* fix(nixpak): drop the duplicate host CJK font and tidy the font overrides

Steam reads the fonts inside its own FHS layer, so the system-wide wqy_zenhei
added for it no longer serves any sandbox. Give gaming-policy its own comment
for FONTCONFIG_FILE instead of leaving it under the compat-tool one, make the
desktop-base value a default, and note the SNI tray grant in the README table.

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/idols-ai/README.md

@@ -24,10 +24,11 @@ Related:
 The disk layout is fully declarative — see [disko-fs.nix](./disko-fs.nix) for the root disk. Run
 `df -Th` / `lsblk` on the host if an up-to-date snapshot of the current mounts is needed.
 
-Steam libraries live under the persisted home directory, so they survive the tmpfs root:
-`~/Games/SteamLibrary` is the library that used to sit on the `/data` disk. Steam finds a moved
-library when it is added once through _Settings → Storage → Add Drive_, or by starting Steam with
-the `libraryfolders.vdf` already listing it.
+Steam libraries live under the persisted `~/Gaming`, the game sandbox's home, so they survive the
+tmpfs root: `~/Gaming/Games/SteamLibrary` (`~/Games/SteamLibrary` inside the sandbox) is the library
+that used to sit on the `/data` disk. Steam finds a moved library when it is added once through
+_Settings → Storage → Add Drive_, or by starting Steam with the `libraryfolders.vdf` already listing
+it.
 
 ## 4090 water block
 

hosts/idols-ai/preservation.nix

@@ -299,21 +299,19 @@ in
         # Games / Media
         # ======================================
 
-        # Home of the game sandboxes (hardening/nixpaks/modules/gaming-policy.nix);
-        # installed games are in ~/Gaming/Games.
+        # Home of the game sandboxes (hardening/nixpaks/modules/gaming-policy.nix).
+        # Steam, Heroic, umu and the games they launch all see it as $HOME, so
+        # their libraries, prefixes, saves and Proton builds live inside it:
+        # ~/Gaming/.local/share/Steam, ~/Gaming/.config/heroic,
+        # ~/Gaming/.local/share/umu, ~/Gaming/Games/... .
         "Gaming"
-        # .desktop entries created by games/installers (including the umu
-        # launchers the nix-config-umu-game skill generates). Home Manager
-        # rewrites its mimeapps.list symlink into the bind mount at activation,
-        # so that survives too.
+        # .desktop entries created on the host for sandboxed launchers. Home
+        # Manager rewrites its mimeapps.list symlink into the bind mount at
+        # activation, so that survives too.
         ".local/share/applications"
-        ".steam"
         ".config/MangoHud"
         ".config/blender"
 
-        ".local/share/umu"
-
-        ".local/share/Steam"
         # WiVRn atomically replaces its settings and pairing files, so preserve
         # the directory rather than individual files.
         {
@@ -324,12 +322,6 @@ in
           directory = ".android"; # ADB host keys for Quest USB authorization
           mode = "0700";
         }
-        ".local/state/Heroic"
-        ".config/heroic"
-
-        ".local/share/GOG.com"
-        ".local/share/StardewValley"
-        ".local/share/feral-interactive"
 
         # ======================================
         # Meeting / Remote Desktop / Recording