coder/desktop: KDE Plasma instead of XFCE

Add image/Dockerfile (published as
git.nic-oconnor.com/public/coder-desktop-kde:noble): enterprise-desktop
noble plus KDE Plasma and KasmVNC 1.5.0, baked in so starts skip apt.
It carries three fixes found testing in the cluster:

- kwin-x11 installed explicitly (only a Recommends; without it Plasma
  runs with no window manager),
- startkde -> startplasma-x11 symlink, since KasmVNC's -select-de kde
  checks for startkde and Plasma 5.20+ renamed it,
- KWin compositing off by default (no GPU; it only adds VNC lag).

The template now uses that image with desktop_environment = "kde" and
pulls Always, and drops the XFCE .xsessionrc seeding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coder/desktop/main.tf

@@ -1,4 +1,4 @@
-# coder/desktop — Coder template: an XFCE desktop in the browser (KasmVNC)
+# coder/desktop — Coder template: a KDE Plasma desktop in the browser (KasmVNC)
 # on the homelab Kubernetes cluster, set up from this dotfiles repo.
 #
 # Push it with:  coder templates push desktop -d coder/desktop
@@ -174,21 +174,14 @@ resource "coder_agent" "main" {
   arch = data.coder_provisioner.me.arch
   os   = "linux"
 
-  # The home PVC hides whatever the image put in /home/coder, so seed it on
-  # first start: the skel dotfiles, plus the image's .xsessionrc (XFCE session
-  # env that KasmVNC's X session reads).
+  # The home PVC hides whatever the image put in /home/coder, so seed it
+  # with the skel dotfiles on first start.
   startup_script = <<-EOT
     set -e
     if [ ! -f ~/.init_done ]; then
       cp -rT /etc/skel ~ || true
       touch ~/.init_done
     fi
-    if [ ! -f ~/.xsessionrc ]; then
-      printf '%s\n' \
-        'export GNOME_SHELL_SESSION_MODE=ubuntu' \
-        'export XDG_CURRENT_DESKTOP=xfce' \
-        'export XDG_SESSION_TYPE=x11' > ~/.xsessionrc
-    fi
   EOT
 
   env = merge({
@@ -235,9 +228,10 @@ module "dotfiles" {
   manual_update        = true
 }
 
-# XFCE is in the image; the module installs KasmVNC and serves it on :6800.
-#   kasm_version: KasmVNC ships a .deb per Ubuntu codename, and the module's
-#     default (1.4.0) is older than we need; 1.5.0 has noble.
+# KDE Plasma and KasmVNC are baked into the image (image/Dockerfile), so the
+# module skips its install and just configures and starts KasmVNC on :6800.
+#   kasm_version: only used if the image lacks KasmVNC; keep it in step with
+#     KASMVNC_VERSION in the Dockerfile.
 #   subdomain = false: the deployment has no wildcard access URL, so the app
 #     is served path-based under coder.nic-oconnor.com.
 module "kasmvnc" {
@@ -245,7 +239,7 @@ module "kasmvnc" {
   source              = "registry.coder.com/coder/kasmvnc/coder"
   version             = "1.3.0"
   agent_id            = coder_agent.main.id
-  desktop_environment = "xfce"
+  desktop_environment = "kde"
   kasm_version        = "1.5.0"
   subdomain           = false
 }
@@ -299,8 +293,9 @@ resource "kubernetes_deployment_v1" "main" {
       }
       spec {
         # Runs as the image's coder user (uid 1000), which has passwordless
-        # sudo. The KasmVNC module and the dotfiles modules (zsh, docker)
-        # need it for apt; the namespace enforces PSA baseline, which allows it.
+        # sudo. The KasmVNC module needs it to write /etc/kasmvnc, and the
+        # dotfiles modules (zsh, docker) for apt; the namespace enforces PSA
+        # baseline, which allows it.
         security_context {
           run_as_user     = 1000
           fs_group        = 1000
@@ -309,8 +304,8 @@ resource "kubernetes_deployment_v1" "main" {
 
         container {
           name              = "dev"
-          image             = "codercom/enterprise-desktop:ubuntu-noble"
-          image_pull_policy = "IfNotPresent"
+          image             = "git.nic-oconnor.com/public/coder-desktop-kde:noble"
+          image_pull_policy = "Always"
           command           = ["sh", "-c", coder_agent.main.init_script]
           env {
             name  = "CODER_AGENT_TOKEN"