Add runtime status checker + headless/X11 docs; distro-support refinements

- status.sh: runtime health check (service state, boot wiring, display backend auto-detect, encoder, ports, web UI, /dev/uinput, pairing) ending in a g2g verdict or concrete TODO list

- docs: TROUBLESHOOTING §12 (headless graphical-session.target boot trap) + §13 (X11/NVENC path & stale wlr drop-in env conflict); ARCHITECTURE capture-backend comparison; FOLLOWUPS P3 (installer X11/Ubuntu support); README diagnostics pointer

- lib/{config,packages,permissions,service}.sh, files/sway-headless.service: in-progress Debian/Ubuntu + headless support refinements

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -200,13 +200,22 @@ The host-side installer handles Linux clients via `moonlight-qt`. For everything
 ## Diagnostics
 
 ```bash
-./install.sh --doctor                                 # run all checks
+./status.sh                                           # runtime health check — is it g2g right now?
+./install.sh --doctor                                 # install-time correctness checks
 systemctl --user status sunshine
 journalctl --user -u sunshine -f
 getcap "$(readlink -f "$(command -v sunshine)")"      # should include cap_sys_admin
 id -nG | tr ' ' '\n' | grep -x input                  # confirm group membership
 ```
 
+`status.sh` walks what's actually *running* — service state, boot wiring,
+display backend (auto-detects x11 / wlr / kms from your `sunshine.conf`),
+encoder, ports, web UI, `/dev/uinput`, and pairing — then prints either
+**g2g** or a concrete TODO list of what needs work (exit 1 if anything's
+broken). Run it as the Sunshine user, or as root (`sudo ./status.sh`, which
+auto-detects the user). `--doctor` is the install-time complement: it checks
+the install is *correct*; `status.sh` checks the host is *up*.
+
 Useful Sunshine ports (auto-opened if a firewall is active):
 
 - TCP: `47984 47989 47990 48010`