Support isolated live window ScreenCast streams

Render selected toplevels through a private portal-only capture protocol, preserve logical snapshot geometry, and renegotiate PipeWire video on window resizing. Bound outstanding snapshots and retry temporary contention; stop on source closure and session locking.

Validation: portal unit tests (31), capture budget unit, private-bus portal contracts, and real nested/PipeWire isolation, workspace, resize, close and paused-lock tests pass. Independent review cleared. Monitor restore integration timed out on both this build and the unchanged previous compositor under the current nested host.

portal/src/main.rs

@@ -20,6 +20,10 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         [flag, name, cursor] if flag == "--stream" => {
             stream::run(name.clone(), cursor == "embedded", None)
         }
+        [flag, id, cursor] if flag == "--stream-window" => {
+            let id: u64 = id.parse()?;
+            stream::run(format!("window:{id}"), cursor == "embedded", None)
+        }
         [flag, name, cursor, generation] if flag == "--stream" => stream::run(
             name.clone(),
             cursor == "embedded",