drm: close the full-review findings (a third latched flag, and two escapees)

The one that matters: the display-cache refresh worker was the THIRD copy of
the wedged-flag hazard. catch_unwind covered only the enumeration, and
thread::spawn panics on EAGAIN after RUNNING was already swapped true, so
either path parked the flag for the process lifetime and every later refresh
- including every udev hotplug - returned early forever. Same ownership
guard as UINPUT_REFRESH_BUSY (the flag is handed back and re-taken mid-loop,
so an unconditional RAII release would clear a replacement worker's flag),
plus a fallible spawn whose failure drops the closure and releases the slot.
DRM_PROBE_IN_FLIGHT, UINPUT_REFRESH_BUSY, now this: the lesson stays
'grep for every site with the shape', and twice was not enough.

Two findings had been flagged in an earlier round and escaped the ledger:
- an unrecognized convert-output fourcc fell through to 'present as BGRA'
  with a debug log, where every sibling validation in that function is a
  hard error that lets the caller fall back to PipeWire. A 64bpp output
  passes the stride check and encodes garbage. Hard error now.
- the trust-boundary validation constants (fourccs, MAX_DIM,
  MAX_FRAME_BYTES) were declared independently on both sides of the split.
  Hoisted into drm_reader, imported by the converter, so the two halves
  cannot drift apart about what data they will touch.

The rest:
- the CI symbol extraction dropped any loader symbol containing a digit and
  degraded to a pass-with-zero-iterations no-op if the b"..." literals were
  ever refactored; digits allowed, count asserted, notice de-hardcoded.
- 'drm' in features was a substring test on the comma-joined string, so a
  future drm-lease feature would have shipped the consent-bypass deb
  without --drm. Exact membership now.
- the security doc claimed the deb is built on an ubuntu18.04 container;
  the only deb job runs on ubuntu-24.04. The 18.04 sentence now says what
  is true: 2.4.95 is an API floor, the binary floor is the build host's.
- DRM_DISPLAY_CACHE poison handling was recover-in-the-writer,
  panic-in-the-readers; both readers now recover like the writer.
- the producer prewarm ran on X11 where no consumer can connect, the same
  inconsistency just fixed for warm_availability. The listener still starts
  (the service outlives sessions; a later Wayland login must find the
  socket), only the prewarm is skipped.

.github/workflows/drm-capture.yml

@@ -172,9 +172,19 @@ jobs:
           SO="$(cat so_path)"
           echo "checking $SO"
           missing=0
-          # Every symbol drmtap_dl.rs resolves, derived from the loader itself so the two cannot drift.
-          for sym in $(grep -oE 'b"drmtap_[a-z_]+"' libs/scrap/src/common/drmtap_dl.rs \
-                       | sed 's/^b"//; s/"$//' | sort -u); do
+          # Every symbol drmtap_dl.rs resolves, derived from the loader itself so the two cannot
+          # drift. The character class allows digits (a drmtap_grab_desc2 would otherwise be
+          # silently dropped from the loop), and the count is asserted below so a refactor of the
+          # loader away from b"..." literals cannot quietly turn this whole check into a no-op that
+          # iterates zero times and passes.
+          syms=$(grep -oE 'b"drmtap_[a-z0-9_]+"' libs/scrap/src/common/drmtap_dl.rs \
+                 | sed 's/^b"//; s/"$//' | sort -u)
+          nsyms=$(echo "$syms" | grep -c .)
+          if [ "$nsyms" -lt 13 ]; then
+            echo "::error::extracted only $nsyms loader symbols from drmtap_dl.rs (expected >= 13); the extraction pattern no longer matches the loader"
+            missing=1
+          fi
+          for sym in $syms; do
             if ! nm -D --defined-only "$SO" | grep -q " T $sym\$"; then
               echo "::error::libdrmtap does not export $sym, which the runtime loader resolves"
               missing=1
@@ -191,7 +201,7 @@ jobs:
             fi
           done
           test "$missing" -eq 0
-          echo "::notice::libdrmtap .so contract ok (13 loader symbols, EGL detile present)"
+          echo "::notice::libdrmtap .so contract ok ($nsyms loader symbols, EGL detile present)"
 
   # The bridge generator is a reusable workflow, so this calls the stock one instead of duplicating it.
   generate-bridge: