Possibly dumb question: why not use an Authentik outpost with a reverse proxy to enforce SSO? It wouldn’t be “baked in” so to speak, but it would be fully OIDC and as long as you’re just running it through a web browser. Biggest downside is you’d need 2 logins (one for the outpost and one for the app). I’d assume the sso is specifically for the extra security though, so that shouldn’t be a problem outside of it being a little hassle.
Compatibility is unlikely to be very different. The key is immutability (easy to update, hard to brick your system) and some baked in nice to haves for gaming like some specific drivers/patches and controller support out of the box.