initial implementation: multi-user Steam shared library via bwrap overlay

Share one Steam game library across multiple Linux users with fully
isolated Proton prefixes. Uses bubblewrap to create a per-user kernel
overlay on /opt/steam/steamapps/compatdata/ so game files stay shared
while Proton prefixes are isolated per user, with no compatibility
tool selection or per-game configuration required.

Includes:
- steam-shared launcher that sets up the per-user overlay and execs
  Steam inside a bwrap mount namespace
- activate/uninstall scripts plus an add-user helper for steamshare
  group membership
- permission watcher (steam-fix-perms.path/.service) to keep ACLs
  correct under pressure-vessel's restrictive mode bits
- .desktop override that routes the system Steam launcher through
  steam-shared
- Nix flake exposing activate, uninstall, and add-user packages
- design doc and implementation plan covering the approach

desktop/steam.desktop

@@ -0,0 +1,46 @@
+[Desktop Entry]
+Name=Steam
+Comment=Application for managing and playing games on Steam
+Exec=steam-shared %U
+Icon=steam
+Terminal=false
+Type=Application
+Categories=Network;FileTransfer;Game;
+MimeType=x-scheme-handler/steam;x-scheme-handler/steamlink;
+Actions=Store;Community;Library;Servers;Screenshots;News;Settings;BigPicture;Friends;
+
+[Desktop Action Store]
+Name=Store
+Exec=steam-shared steam://store
+
+[Desktop Action Community]
+Name=Community
+Exec=steam-shared steam://url/SteamIDControlPage
+
+[Desktop Action Library]
+Name=Library
+Exec=steam-shared steam://open/games
+
+[Desktop Action Servers]
+Name=Servers
+Exec=steam-shared steam://open/servers
+
+[Desktop Action Screenshots]
+Name=Screenshots
+Exec=steam-shared steam://open/screenshots
+
+[Desktop Action News]
+Name=News
+Exec=steam-shared steam://open/news
+
+[Desktop Action Settings]
+Name=Settings
+Exec=steam-shared steam://open/settings
+
+[Desktop Action BigPicture]
+Name=Big Picture
+Exec=steam-shared steam://open/bigpicture
+
+[Desktop Action Friends]
+Name=Friends
+Exec=steam-shared steam://open/friends