Add reproducible headless desktop for the X11/NVENC capture path

A Moonlight client connecting to the x11-backend host got a black screen
even though pairing, NVENC, and input injection all worked: the headless
Xorg on :0 had no window manager rendering on it, so capture=x11 grabbed
an empty black root window. (The wlr/kms backends don't hit this — their
capture source renders for itself.)

This was a hand-built path with nothing in the repo to reproduce the
desktop piece. Now:

- files/headless-desktop.service: Openbox session on :0, bound to
  xorg-headless.service, enabled via default.target for lingering boots,
  with a best-effort xsetroot so the desktop is visibly non-black.
- lib/headless.sh: capture_backend_is_x11 + install_headless_desktop
  (idempotent; pulls openbox/xsetroot via the distro dispatch).
- install.sh: installs the desktop unit when capture=x11 is detected.
- status.sh: x11 branch now FAILs if no window manager is on :0 instead
  of only checking the X server answers — the gap that hid this failure.
- docs: TROUBLESHOOTING §13 black-screen lesson; FOLLOWUPS P3 updated.

Part of the P3 x11-backend work; --backend flag, config.sh x11 variant,
and xorg-headless templates remain outstanding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/headless.sh

@@ -34,6 +34,61 @@ _headless_hook_sources() {
   esac
 }
 
+# The X11/NVENC headless backend (capture = x11, headless Xorg on :0) isn't
+# selected by --headless/--mirror — those pick the *Wayland* capture method.
+# It's identified by an existing `capture = x11` in sunshine.conf, the
+# hand-built path documented in FOLLOWUPS.md P3. When that backend is in play,
+# the headless Xorg needs a window manager rendering on :0 or Sunshine
+# captures a black screen.
+capture_backend_is_x11() {
+  local conf="$HOME/.config/sunshine/sunshine.conf"
+  [[ -f "$conf" ]] || return 1
+  grep -qE '^[[:space:]]*capture[[:space:]]*=[[:space:]]*x11' "$conf"
+}
+
+HEADLESS_DESKTOP_UNIT="headless-desktop.service"
+
+# Pull the lightweight WM (Openbox) we drive on :0, plus xsetroot for the
+# solid-background touch. Idempotent — pkg_install skips what's present.
+ensure_headless_desktop_packages() {
+  command -v openbox-session >/dev/null 2>&1 || pkg_install openbox
+  if ! command -v xsetroot >/dev/null 2>&1; then
+    case "$DISTRO" in
+      debian) pkg_install x11-xserver-utils ;;
+      arch)   pkg_install xorg-xsetroot ;;
+    esac
+  fi
+}
+
+# Install + enable the Openbox session that renders onto the headless Xorg
+# display (:0), so the X11/NVENC capture path has something to show instead of
+# a black root window. Idempotent: safe to re-run. Bound to xorg-headless.service
+# and to default.target (the lingering-user manager reaches it without a login).
+install_headless_desktop() {
+  local src="$SCRIPT_DIR/files/headless-desktop.service"
+  if [[ ! -f "$src" ]]; then
+    err "Desktop unit source missing: $src"
+    return 1
+  fi
+
+  ensure_headless_desktop_packages
+
+  local unit_dir="$HOME/.config/systemd/user"
+  mkdir -p "$unit_dir"
+  install -m 0644 "$src" "$unit_dir/$HEADLESS_DESKTOP_UNIT"
+  systemctl --user daemon-reload
+
+  # enable --now starts it immediately when a user manager is live; on a fresh
+  # headless box with no session yet, fall back to enable-only so it comes up
+  # on next boot via default.target.
+  if systemctl --user enable --now "$HEADLESS_DESKTOP_UNIT" >/dev/null 2>&1; then
+    ok "Enabled $HEADLESS_DESKTOP_UNIT (Openbox session on :0)"
+  else
+    systemctl --user enable "$HEADLESS_DESKTOP_UNIT" >/dev/null 2>&1 || true
+    warn "Installed $HEADLESS_DESKTOP_UNIT but couldn't start it now — it will start on next login/boot."
+  fi
+}
+
 install_headless_hooks() {
   mkdir -p "$HEADLESS_BIN_DIR"
   mapfile -t srcs < <(_headless_hook_sources)