… isolation)

From the high-effort workflow review of the branch — all findings resolved:

Crashes / data loss:
- util.rs clear_tmp(): reap only dead-pid orphan scratch instead of rm -rf'ing the
  whole tmp/ tree (could delete through a concurrent live session's overlay into
  the player's save upperdir).
- steamless.rs has_steamstub_elf(): bounds-check the packer-controlled ELF section
  name offset so a bad offset returns 'not DRM' instead of panicking the launch.

Launch correctness (this session's gamescope-bypass + Keen work):
- execute.rs no_gamescope: gate on the resolved seat-list emptiness (matching
  build_cmds) not inst.together, so a failed together seat can't make the WM wait
  for a gamescope window that was never built and kill the game.
- keen.rs extra_launch_args(): skip --keenonline-server-data-file when the
  sideloaded emu binary is absent (lockstep with start_services' guard).

Concurrency isolation:
- standalone.rs: overlay under the per-launch namespaced tmp dir.
- keen.rs data_file_path(): per-launch namespaced (loopback port still emu-side).
- proton.rs get_prefix_path(): disambiguate two same-profile instances in one
  launch with a -p<n> suffix (first keeps its bare per-profile prefix) so Proton's
  prefix file-lock can't block the 2nd from booting.

Window-manager layout:
- niri.rs fullscreen: always honor the assigned monitor; never auto-spread onto
  another output (could land on a virtual Sunshine display → wedge). Removed the
  now-dead displays_assigned plumbing.
- niri.rs tile_windows_on_monitor: index the original window snapshot instead of
  re-fetching + stale-indexing.
- layout.rs Grid: honor window_count instead of a fixed 2x2.

Gamepad-type seats used to be the only ones getting the seat pad wired
(a phantom-controller precaution) which left kbm-type together seats padless
in-game. All input now goes to all together seats.