Console plug-and-play layer: always-on, BPM autostart, game launchers

- Mask all suspend paths + dconf no-sleep/no-lock defaults (local + GDM):
  the console must stay reachable over SSH/RDP at all times
- Autostart Steam Big Picture Mode for the kid account only
- Enable tailscaled (idle until 'tailscale up')
- First-boot flatpaks: ProtonUp-Qt, Heroic, RetroDECK

Already in the bazzite base, so not added: Steam, Tailscale, automatic
updates (uupd.timer), Firefox via first-boot flatpak manager.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

recipes/bc250-console-gnome.yml

@@ -24,15 +24,31 @@ modules:
 
   - type: script
     snippets:
-      - chmod 0755 /usr/bin/bc250-remote-setup
+      - chmod 0755 /usr/bin/bc250-remote-setup /usr/bin/bc250-steam-bpm-autostart
+      - dconf update # compile the local.d/gdm.d console defaults into the dconf dbs
+
+  - type: default-flatpaks
+    notify: true
+    system:
+      install:
+        - net.davidotek.pupgui2 # ProtonUp-Qt: Proton-GE manager
+        - com.heroicgameslauncher.hgl # Heroic: Epic + GOG
+        - net.retrodeck.retrodeck # RetroDECK: retro emulation
 
   - type: systemd
     system:
       enabled:
         - cyan-skillfish-governor-smu.service
         - sshd.service
+        - tailscaled.service # idle until 'sudo tailscale up'
       masked:
         - hhd.service # Handheld Daemon crash-loops on BC-250
+        # Always-on console: hard-block every suspend path (the box must
+        # stay reachable over SSH/RDP even from the login screen)
+        - sleep.target
+        - suspend.target
+        - hibernate.target
+        - hybrid-sleep.target
 
   # No signing module: this image is built locally and installed via ISO.
   # If you ever push to a registry for OTA `bootc upgrade`, generate your own