drm: ship the wake in the CI deb, and assert the artifact on both package paths

Three findings from the round on the wake-gate commits, all the same shape: the
gate made "what was asked for" and "what was produced" diverge, and two places
still trusted the first.

CI built the unattended-wayland deb with `--features ...,drm` and then packaged
it with `--skip-cargo`. build.py appends `drm-wake` for `--drm`, but skipping
cargo means whatever that explicit line compiled is what ships, so the deb had
no wake code in it at all while being named and documented as the variant that
has it. The feature list has to be complete on the line that actually builds.

The marker assertion that catches exactly this class only guarded one of the two
packaging paths. `build_deb_from_folder` asserts that the staged binary carries
the libdrmtap dlopen path before it takes the unattended-wayland name; the
flutter path did not, and `--skip-cargo` reaches that one. A stock binary could
therefore be packaged under a name that conflicts with and replaces the stock
package, and then never capture. Hoisted the check to module level and called it
from both, before the bundle is renamed.

And the security doc described the synthetic input injection as an unconditional
property of a drm build. It is behind its own compile feature and a runtime
option, which is exactly what an operator auditing the deb needs to know.

docs/DRM_CAPTURE_SECURITY.md

@@ -142,7 +142,12 @@ presents) but reuses RustDesk's own hardened IPC.
   rather than fail. The conversion then happens in the service, on the device it
   already has open, so it is correct by construction. Hosts with a single render
   node have nothing to pick wrong and keep the DMA-BUF fast path.
-- **The display wake injects synthetic input from the root service.** A
+- **The display wake injects synthetic input from the root service.** It is
+  compiled in only with the `drm-wake` feature, which `build.py --drm` adds on
+  top of `drm`, and it can be switched off at runtime with
+  `enable-drm-display-wake=N`. Building with `--features drm` alone leaves no
+  wake code in the binary at all, so an operator auditing the deb can answer
+  "is the injection path even present here?" from the artifact. A
   compositor that idles long enough DISABLES a connector, leaving no scanout for
   any backend, so on a `_drm` handshake that finds a CONNECTED display with no
   CRTC the service emits one synthetic pointer round trip over `/dev/uinput` to