fix: Add single user no password option with SDDM, fetch newest Vapor presets

- One wizard question: "single user, no password, like SteamOS" switches
  to SDDM (autologin via CachyOS's own steam-set-session, no workarounds)
  and removes lock screen, user switching and log out (launcher shows only
  Sleep/Restart/Shut Down; Meta+L and Ctrl+Alt+Del unbound). Declining
  keeps the current login manager and KDE's defaults
- Look up the newest steamdeck-kde-presets from Valve's release repos and
  verify its SHA-256; take over the new SteamOS 3.9 defaults
- Restart plasmashell through systemd so the desktop keeps the session's
  dark theme; drop the bundled icon in favour of Valve's and Steam's
- README and AGENTS.md updated

lib/steam-desktop.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
-# Steam in the Plasma desktop session: gamepad UI args, virtual keyboard, autostart.
+# Steam in the Plasma desktop session: gamepad UI args, virtual keyboard,
+# autostart, and no screen locking (like SteamOS).
 # Sourced by setup-gamescope-boot.sh; not meant to be run on its own.
 
 setup_steam_desktop() {
@@ -52,3 +53,71 @@ EOF
 
     ok "Steam UI parameters and keyboard autostart deployed successfully."
 }
+
+setup_single_user() {
+    # With SINGLE_USER (chosen in step 1), like SteamOS: one user and no
+    # password prompts, since typing a password with a controller is
+    # miserable. Hides Lock / Switch User / Log Out
+    # everywhere (launcher, Meta+L, Ctrl+Alt+Del) and never locks on idle or
+    # resume; "Return to Gaming Mode" is the way out of the desktop. Declining
+    # restores KDE's defaults.
+    local action allow=true
+    [[ "$SINGLE_USER" == true ]] && allow=false
+    for action in lock_screen switch_user start_new_session; do
+        kwriteconfig6 --file kdeglobals --group "KDE Action Restrictions" --key "action/$action" "$allow"
+    done
+    if [[ "$allow" == false ]]; then
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Autolock false
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key LockOnResume false
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Timeout 0
+        # The action restriction hides Lock in menus but not the Meta+L
+        # shortcut; unbind it (format: current,default,description).
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Lock Session" \
+            $'none,Screensaver\tMeta+L,Lock Session'
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Log Out" \
+            'none,Ctrl+Alt+Del,Show Logout Screen'
+        set_launcher_leave_buttons single
+        ok "Screen locking, user switching and logging out disabled."
+    else
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Autolock --delete
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key LockOnResume --delete
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Timeout --delete
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Lock Session" \
+            $'Screensaver\tMeta+L,Screensaver\tMeta+L,Lock Session'
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Log Out" \
+            'Ctrl+Alt+Del,Ctrl+Alt+Del,Show Logout Screen'
+        set_launcher_leave_buttons default
+        ok "Keeping KDE's normal screen locking and user switching."
+    fi
+}
+
+set_launcher_leave_buttons() {
+    # "single": only Sleep / Restart / Shut Down buttons in the launcher, no
+    # Session dropdown (that's where Log Out lives). Restricting the
+    # "logout" action instead would also hide Restart and Shut Down.
+    # "default": Plasma's own buttons.
+    local mode="$1" applet
+    for applet in $(plasma_applets org.kde.plasma.kickoff); do
+        local -a grp=(--file plasma-org.kde.plasma.desktop-appletsrc --group Containments
+            --group "${applet%%:*}" --group Applets --group "${applet#*:}"
+            --group Configuration --group General)
+        if [[ "$mode" == single ]]; then
+            kwriteconfig6 "${grp[@]}" --key primaryActions 3
+            kwriteconfig6 "${grp[@]}" --key systemFavorites 'suspend,reboot,shutdown'
+        else
+            kwriteconfig6 "${grp[@]}" --key primaryActions --delete
+            kwriteconfig6 "${grp[@]}" --key systemFavorites --delete
+        fi
+    done
+    if pgrep -u "$USER" -x plasmashell >/dev/null; then
+        local js
+        if [[ "$mode" == single ]]; then
+            js="w.writeConfig('primaryActions', 3); w.writeConfig('systemFavorites', 'suspend,reboot,shutdown');"
+        else
+            js="w.writeConfig('primaryActions', 0); w.writeConfig('systemFavorites', 'suspend,hibernate,reboot,shutdown');"
+        fi
+        qdbus6 org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.evaluateScript \
+            "panels().forEach(function (p) { p.widgets('org.kde.plasma.kickoff').forEach(function (w) { w.currentConfigGroup = ['General']; $js w.reloadConfig(); }); })" \
+            >/dev/null 2>&1 || true
+    fi
+}