startcce: pin glvnd EGL to Mesa so the compositor never opens the dGPU

WLR_DRM_DEVICES keeps cce-fx off the NVIDIA KMS node, but glvnd's libEGL
probes every installed vendor when a display is created, and
libEGL_nvidia opens /dev/nvidiactl and /dev/nvidia0 to answer. That held
the discrete GPU out of runtime D3 for the whole session (~3 W on
battery, never suspended). __EGL_VENDOR_LIBRARY_FILENAMES pinned to
Mesa's vendor file means the NVIDIA EGL is never loaded; imported into
the user manager like VK_DRIVER_FILES so launcher-spawned EGL clients
follow. GLX and Vulkan are separate mechanisms and keep their own
overrides.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

 scripts/startcce | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/scripts/startcce b/scripts/startcce
index fa66d985..2ca9e1f0 100755
--- a/scripts/startcce
+++ b/scripts/startcce
@@ -57,6 +57,19 @@ export WLR_DRM_DEVICES=/dev/dri/card1
 # script's, and without the import they ran under a different GPU setup than
 # anything the compositor spawned directly.
 export VK_DRIVER_FILES=/usr/share/vulkan/icd.d/intel_icd.json
+# EGL gets the same pin. WLR_DRM_DEVICES keeps the compositor off the NVIDIA
+# KMS node, but glvnd's libEGL still probes every installed vendor when a
+# display is created, and libEGL_nvidia opens /dev/nvidiactl and /dev/nvidia0
+# to answer — so the compositor held the discrete GPU out of its runtime-D3
+# sleep for the whole session (2026-09-28 audit: ~3 W on battery, never
+# suspended). Pinning glvnd to Mesa's vendor file means the NVIDIA EGL is
+# never loaded. Nothing is lost: every external port is wired to the
+# discrete GPU and WLR_DRM_DEVICES already excludes them, and GLX (Xwayland
+# apps, __GLX_VENDOR_LIBRARY_NAME) and Vulkan (CCE_VK_DEVICE lifts the pin
+# per process) are separate mechanisms. Imported below like VK_DRIVER_FILES,
+# for the same reason: a launcher-spawned EGL client would otherwise wake
+# the GPU too.
+export __EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json
 # Mesa's rusticl exposes NO OpenCL devices unless enabled per driver — without
 # this the session has zero OpenCL platforms from Mesa, and every OpenCL
 # consumer that wants the Intel GPU fails quietly: the designer's
@@ -127,7 +140,7 @@ fi
 # literal '$CCE_BIN' and the client would never start.
 cat > "$CCE_LAUNCH" << LAUNCH_EOF
 #!/bin/sh
-systemctl --user import-environment DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_SESSION_ID XDG_RUNTIME_DIR GNOME_KEYRING_CONTROL SSH_AUTH_SOCK RUSTICL_ENABLE VK_DRIVER_FILES${TERMINAL:+ TERMINAL}
+systemctl --user import-environment DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_SESSION_ID XDG_RUNTIME_DIR GNOME_KEYRING_CONTROL SSH_AUTH_SOCK RUSTICL_ENABLE VK_DRIVER_FILES __EGL_VENDOR_LIBRARY_FILENAMES${TERMINAL:+ TERMINAL}
 systemctl --user start cce-session.target
 ${DEBUG_FLAG}exec "$CCE_BIN" client 2>"$CCE_CLIENT_LOG"
 LAUNCH_EOF