coder/desktop: KDE Plasma instead of XFCE

Add image/Dockerfile (published as
git.nic-oconnor.com/public/coder-desktop-kde:noble): enterprise-desktop
noble plus KDE Plasma and KasmVNC 1.5.0, baked in so starts skip apt.
It carries three fixes found testing in the cluster:

- kwin-x11 installed explicitly (only a Recommends; without it Plasma
  runs with no window manager),
- startkde -> startplasma-x11 symlink, since KasmVNC's -select-de kde
  checks for startkde and Plasma 5.20+ renamed it,
- KWin compositing off by default (no GPU; it only adds VNC lag).

The template now uses that image with desktop_environment = "kde" and
pulls Always, and drops the XFCE .xsessionrc seeding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coder/desktop/README.md

@@ -1,7 +1,7 @@
 # coder/desktop — Coder desktop template
 
-A Coder template for <https://coder.nic-oconnor.com>: an XFCE desktop in the
-browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
+A Coder template for <https://coder.nic-oconnor.com>: a KDE Plasma desktop in
+the browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
 running as a pod on the homelab Kubernetes cluster, set up from this repo by the
 [dotfiles module](https://registry.coder.com/modules/coder/dotfiles).
 
@@ -15,14 +15,42 @@ coder templates push desktop -d coder/desktop -y
 The in-cluster provisioner uses the `coder` service account, whose workspace
 Role is bound in the `coder` namespace — which is where workspaces go.
 
+## The image
+
+`image/Dockerfile` builds `git.nic-oconnor.com/public/coder-desktop-kde:noble`:
+`codercom/enterprise-desktop:ubuntu-noble` plus KDE Plasma (with Dolphin,
+Konsole, Kate) and KasmVNC. Both are baked in because only `/home/coder` is
+persisted, so installing them at start time would cost minutes on every
+start. The package is public on Gitea, so the cluster pulls it without a
+secret. Rebuild after changing the Dockerfile:
+
+```sh
+docker build -t git.nic-oconnor.com/public/coder-desktop-kde:noble coder/desktop/image
+docker push git.nic-oconnor.com/public/coder-desktop-kde:noble
+```
+
+The pod pulls with `Always`, so workspaces pick the new image up on their
+next start.
+
+Workarounds the Dockerfile carries:
+
+- `kwin-x11` is installed explicitly. It is only a Recommends of
+  `kde-plasma-desktop`, and without it Plasma starts with no window manager.
+- `/usr/local/bin/startkde -> startplasma-x11`. KasmVNC's `-select-de kde`
+  (what the module runs) checks for `startkde`, which Plasma 5.20+ renamed,
+  and otherwise fails with "Desktop Environment not installed".
+- KWin compositing is off in `/etc/xdg/kwinrc`: there is no GPU, and
+  software compositing over VNC only adds lag. Turn it back on in System
+  Settings if you want it.
+
 ## What a workspace gets
 
-- `codercom/enterprise-desktop:ubuntu-noble`: XFCE, git, python3, and the
-  `coder` user (uid 1000) with passwordless sudo.
+- The image above, running as the `coder` user (uid 1000) with passwordless
+  sudo.
 - A PVC (`truenas-iscsi`, default 30 GiB) at `/home/coder`. Everything the
-  dotfiles install into `$HOME` survives stops; system packages (zsh, docker
-  CLI, KasmVNC) are reinstalled on each start because the root filesystem
-  is not persisted.
+  dotfiles install into `$HOME` survives stops, and so do the Plasma settings.
+  System packages the dotfiles add (zsh, the docker CLI) are reinstalled on
+  each start.
 - The KasmVNC app, path-based (`subdomain = false`) because the deployment has
   no wildcard access URL.
 - A "Dotfiles" startup script: clones this repo into
@@ -42,9 +70,9 @@ bootstrap still applies everything else; `secrets`, `mcp-config` and `hermes`
 are reported as not completed. Fix that later from a workspace terminal with
 `~/.config/coderv2/dotfiles/secrets/install.sh`, then refresh the dotfiles.
 
-## Why these pins
+## Why noble
 
-- `ubuntu-noble`, not `ubuntu`: the `ubuntu` tag is now 26.04 (resolute), and
-  KasmVNC publishes no resolute package, so the module's install 404s.
-- `kasm_version = "1.5.0"`: the newest KasmVNC release, which has a noble
-  build. Revisit both once KasmVNC ships a resolute `.deb`.
+The `enterprise-desktop:ubuntu` tag is now 26.04 (resolute), and KasmVNC
+publishes no resolute package. The image is pinned to noble with KasmVNC
+1.5.0; revisit once KasmVNC ships a resolute `.deb`, and keep
+`kasm_version` in `main.tf` in step with `KASMVNC_VERSION`.