drm: the same latched-flag bug a fourth time, in my own fix for the third

I built UinputRefreshGuard INSIDE the spawned closure, so it only covered
paths where the closure ran. thread::spawn panics on EAGAIN after the swap,
so no guard existed and the flag stayed set for the process lifetime, which
is the exact failure the guard was introduced to prevent. I then wrote
RefreshSlot correctly - constructed before the spawn, moved in - two hours
later and did not go back to fix its sibling. Both are right now, and the
spawn is fallible in both.

Also from the review:

- DRMTAP_PREBUILT_DIR returned before the EGL-stub assertion, so the check
  only guarded the source build. That is backwards: prebuilt-dir is the
  widest override (no fetch, no sha check, an object this script never sees),
  the likeliest to hand over a stub, and the path our aarch64 cross-build
  actually uses. Verified the assertion accepts a real .so and rejects one
  built with -Degl=disabled.
- convert() bounded only the frame libdrmtap returns, not the descriptor going
  in. offsets/pitches address plane ranges inside the dma-buf, so those are
  what a malformed pair would reach past. Bounded per populated plane, the
  same way the export side is. Defense in depth (the producer is
  root-authenticated and libdrmtap validates against the fd since 0.4.12),
  but the two halves should agree before the C sees the data, not after.
- the flutter patch step used '[[ test ]] && git apply' as its last command,
  so the step would FAIL rather than skip the first time FLUTTER_VERSION
  moves off 3.24.5. Explicit if/else, and the values now come from the
  environment instead of ${{ }} interpolation, which also clears zizmor's
  template-injection warning. Checked both branches.

Declined: the cursor id/cache-key convergence finding. Both accessors use one
selection over one map, so they can only disagree across a publish race, and
state.hcursor is already set to the id ACTUALLY served (drm_served_id), which
is the sync the finding asks for - added in an earlier round.

src/server/drm_capturer.rs

@@ -797,10 +797,15 @@ async fn recv_thread(
                 // runs ONE thread and the final layout wins. Not ordered against frame delivery.
                 UINPUT_REFRESH_GEN.fetch_add(1, Ordering::AcqRel);
                 if !UINPUT_REFRESH_BUSY.swap(true, Ordering::AcqRel) {
-                    std::thread::spawn(|| {
-                        // We hold the flag from the swap above; the guard hands it back on every
-                        // exit from here, including a panic inside the refresh below.
-                        let mut busy = UinputRefreshGuard(true);
+                    // Take ownership of the flag BEFORE the spawn and move it into the closure.
+                    // Constructing the guard inside the closure only covers paths where the closure
+                    // actually runs: `thread::spawn` panics on EAGAIN, and that happens after the
+                    // swap above, so no guard would ever exist and the flag would stay set for the
+                    // process lifetime. Same mistake, same shape, as the two flags before it.
+                    let mut busy = UinputRefreshGuard(true);
+                    let spawned = std::thread::Builder::new()
+                        .name("drm-uinput-refresh".into())
+                        .spawn(move || {
                         let rt = match tokio::runtime::Builder::new_current_thread()
                             .enable_all()
                             .build()
@@ -835,6 +840,12 @@ async fn recv_thread(
                             }
                         }
                     });
+                    if let Err(err) = spawned {
+                        // The closure never ran, so it was dropped along with the guard it owned,
+                        // and the guard released the slot: the next topology change retries the
+                        // spawn instead of being locked out for the process lifetime.
+                        log::error!("drm: could not spawn the uinput refresh worker: {err}");
+                    }
                 }
             }
             _ => {} // ignore any unexpected control message