initial implementation: multi-user Steam shared library via bwrap overlay

Share one Steam game library across multiple Linux users with fully
isolated Proton prefixes. Uses bubblewrap to create a per-user kernel
overlay on /opt/steam/steamapps/compatdata/ so game files stay shared
while Proton prefixes are isolated per user, with no compatibility
tool selection or per-game configuration required.

Includes:
- steam-shared launcher that sets up the per-user overlay and execs
  Steam inside a bwrap mount namespace
- activate/uninstall scripts plus an add-user helper for steamshare
  group membership
- permission watcher (steam-fix-perms.path/.service) to keep ACLs
  correct under pressure-vessel's restrictive mode bits
- .desktop override that routes the system Steam launcher through
  steam-shared
- Nix flake exposing activate, uninstall, and add-user packages
- design doc and implementation plan covering the approach

flake.nix

@@ -0,0 +1,48 @@
+{
+	description = "Multi-user shared Steam library for Linux using bubblewrap overlay";
+
+	inputs = {
+		nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+	};
+
+	outputs = { self, nixpkgs, ... }:
+		let
+			supportedSystems = [ "x86_64-linux" "aarch64-linux" ];
+			forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+		in
+		{
+			packages = forAllSystems (system:
+				let
+					pkgs = nixpkgs.legacyPackages.${system};
+
+					activate = pkgs.writeShellApplication {
+						name = "steam-shared-activate";
+						runtimeInputs = with pkgs; [ acl coreutils findutils ];
+						text = ''
+							exec "${self}/scripts/activate.sh" "$@"
+						'';
+					};
+
+					uninstall = pkgs.writeShellApplication {
+						name = "steam-shared-uninstall";
+						runtimeInputs = with pkgs; [ coreutils ];
+						text = ''
+							exec "${self}/scripts/uninstall.sh" "$@"
+						'';
+					};
+
+					add-user = pkgs.writeShellApplication {
+						name = "steam-shared-add-user";
+						runtimeInputs = with pkgs; [ coreutils ];
+						text = ''
+							exec "${self}/scripts/add-user.sh" "$@"
+						'';
+					};
+				in
+				{
+					inherit activate uninstall add-user;
+					default = activate;
+				}
+			);
+		};
+}