feat(nixpak): sandbox umu-launcher with ~/Gaming as its home (#519)

* feat(nixpak): sandbox umu-launcher with ~/Games as its home

umu-run, winetricks and bbe leave the host PATH, so umu launchers
generated before this stop working until rewritten with
`umu-install.nu <name> - <launcher> <gameid>`.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* refactor(nixpak): mount ~/Gaming as the game sandbox home

idols-ai now preserves ~/Gaming instead of ~/Games, so existing games
vanish from the host after deploy until the preserved ~/Games is moved
to ~/Gaming/Games.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* docs(nixpak): record umu runtime validation

Assisted-by: Claude Agent SDK (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)

hardening/nixpaks/modules/desktop-base.nix

@@ -11,6 +11,7 @@
   imports = [
     ./portal-groups.nix
     ./desktop-integration.nix
+    ./xdg-storage.nix
   ];
   gpu = {
     enable = lib.mkDefault true;
@@ -48,22 +49,6 @@
       pipewire = lib.mkDefault false;
     };
     bind.rw = with sloth; [
-      [
-        (mkdir appCacheDir)
-        xdgCacheHome
-      ]
-      [
-        (mkdir appConfigDir)
-        xdgConfigHome
-      ]
-      [
-        (mkdir appDataDir)
-        xdgDataHome
-      ]
-      [
-        (mkdir (concat' appDir "/state"))
-        xdgStateHome
-      ]
       (concat' runtimeDir "/doc")
       # Chrome/Firefox/Telegram/etc. use /tmp for single-instance IPC. Share
       # this directory across launches of the same app only; app IDs differ.