…dow ownership

splitux could only run ONE session per host: every launch keyed its scratch by
instance index (tmp/game-0, work-0, <backend>-overlay-0), so a 2nd concurrent
launch collided on the fuse-overlayfs mounts ("mount failed"); teardown unmounted
ALL tmp/game-* globally; the startup unit-sweep stopped other live sessions; and
the niri WM grabbed EVERY gamescope window (stacking all sessions into one column
+ cross-repositioning that crashed games).

Each `splitux launch` is its own process with one active launch, so namespace all
per-launch state by a per-process launch id:
- paths: set_launch_ns() / launch_tmp_dir() = tmp/<launch_id>; scratch (game-N,
  work-N, <backend>-overlay-N, game-patches) now lives under it. overlays.rs,
  build_cmds.rs and backend overlay all route through it (mount + cwd agree).
- teardown: fuse_overlayfs_unmount_gamedirs() is launch-scoped (only this
  launch's tmp/<ns>, then removes it) — concurrent sessions untouched. session.rs
  end-of-launch cleanup uses it instead of the blanket clear_tmp().
- startup: sweep_orphan_units() skips units whose owner pid is still alive (other
  live sessions); reap_orphan_launch_scratch() removes only DEAD-pid tmp/<ns>.
- WM: niri get_gamescope_windows() filters to windows whose pid cgroup carries
  THIS launch's namespace (splitux-<ns>), so each session manages only its own
  gamescope window. Falls back to all when unscoped.

Validated: 3 native couch games launched concurrently — distinct namespaces, 6
seats, each WM "Found 1 window" + mapped, no mount collision.

…eanup

Per-instance capture/mute virtual sinks for both PulseAudio and PipeWire,
with orphan-sink reaping that recovers from dead launches without
disturbing live concurrent sessions. Threads per-instance audio and
namespaced scratch through launch (scope/build_cmds/execute), bwrap base,
and together so multiple sessions run isolated side by side.