drm: address the phase-2 split review

1- do not depend on the libdrmtap-sys crate for the pin: its build.rs statically
compiles the whole libdrmtap C tree and a CAP_SYS_ADMIN helper and links
-ldrm/-lseccomp/-lcap, which defeats the runtime-dlopen model. keep drm a pure
dlopen backend and pin the .so by the build.py DRMTAP_REF release tag, guarded by
a strict vX.Y.Z regex. drops the now-moot Cargo.lock freshness CI checks.
2- render-node-less consumers no longer lose the stream: the --server signals
need_cpu on DrmStart when it cannot open a convert context, and the --service
streams the CPU-converted frame path for that connection instead of a dma-buf fd
the consumer cannot detile (which used to fall through to a PipeWire path nobody
can approve on an unattended seat).
3- mark PipeWire initialized only after every per-display capturer is created, so
a partial failure retries instead of the flag falsely reporting a complete init.
4- reject a degenerate (zero width/height) or short CPU frame before it reaches
PixelBuffer::new (which derives stride as data.len()/height, dividing by zero).
5- keep the export-ledger epoch at DRM_DISPLAY_GENERATION so a hotplug invalidates
cached buffers (elision stays off until the recycled-fb_id inode case is handled).
6- validate the udev uevent source (kernel nl_pid, multicast) with recvmsg so a
local process cannot unicast a spoofed drm-change event to the root listener.

Cargo.lock

@@ -4485,16 +4485,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "libdrmtap-sys"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c52136bd2bf94bb1071f3926eff327148faddc704338f3fca473e1d1974723"
-dependencies = [
- "cc",
- "pkg-config",
-]
-
 [[package]]
 name = "libgit2-sys"
 version = "0.14.2+1.5.1"
@@ -7620,7 +7610,6 @@ dependencies = [
  "hwcodec",
  "jni",
  "lazy_static",
- "libdrmtap-sys",
  "log",
  "ndk 0.7.0",
  "ndk-context",