feat(desktop): add consented multi-monitor Wayland serving

[rldyourmnd]

Add an explicit prepared Wayland backend so a consented desktop can expose multiple monitors through the existing independent RDS sessions. The agent owns a generic DesktopSource; RemoteDesktop/ScreenCast, PipeWire and EI types stay below that seam. Remote callers cannot open a local consent dialog.

The native backend keeps one combined session, a private rotating restore token and display numbering, current stream-to-EI region mapping, newest bounded BGRA/BGRx pixels, eight software encoder slots and 64 controlling leases. EI requests share only RDS-owned key/button holds and invalidate old leases on pause/removal, deadline or worker exit. Native objects remain on their bounded worker without unsafe Send wrappers. X11 rejects known Wayland environments and the actual XWAYLAND server extension.

Pending Start explicitly subscribes before sending and retains its own Request path: cancellation closes Request before Session and the unique bus peer. The SDK convenience API returned Request only after user Response, so it could not provide that cancellation boundary. Standard zbus Start is the narrow native adapter; ashpd still owns typed portal interfaces, FD exchange and result parsing. Token-bearing results are not logged.

Validation: final registered w4-wayland-portal passed 1,016 executions, zero failures, three explicit qualification ignores and 100 shared endpoint handshake samples; 33 intact gate/review receipts. The original generated report is retained with its exact hash, and the separate review explains the remaining product gates. Final targeted checks passed 17 portal boundary cases (real EI socket pair, directed early D-Bus consent responses, denial and identity mismatch, Request.Close, frame/geometry/state and unwind), 10 CLI preflight cases on each OS, four real QUIC service-policy cases and 14 isolated Xvfb native cases. Linux portal and macOS default/desktop/portal strict Clippy, formatting and cargo-deny passed. A separate hosted Linux portal lane installs ABI headers and checks the feature. YAML/actionlint and combined owned-transport/desktop/portal checks also passed after fixing the hosted command scalar and an old priority-test argument. Original hosted and draft failures remain in the dated report.

Native functional qualification now passed on GNOME 50: two real Full HD/4K streams, three decoded frames each, restored permission with stable per-history IDs and both EI sync ACKs. The opt-in sync check emits no application input. Local SIGTERM joined the request/session/connection owner. Physical key/pointer-to-pixel behavior, compositor-initiated revocation, hotplug and installed multi-device acceptance retain separate gates; see docs/reports/rds-wayland-native-20261011.md. The final checkpoint/review evidence is committed. All hosted checks passed at the code-identical 90b361c candidate on Ubuntu/macOS; the final documentation/evidence-only head has its own asynchronous checks. Private installed LAN media/GUI rollout is independently recorded outside this public module. Portal clipboard, relative pointer input, hardware codecs, hotplug identity acceptance and unattended login-screen access are not claimed. The dependency additions are pinned ashpd 0.13.13, pipewire 0.10.0 and reis 0.7.1 primitives; no remote desktop framework or service wire version is added.