drm: stop leaking the authorized _drm fd into forked children

libc::dup() does not copy the close-on-exec flag, so the dup'd _drm socket fd
was inherited by every child this process forks. This process is the ROOT
service and it does fork synchronously elsewhere (the loginctl active-uid
lookup), and that fd is an ALREADY-AUTHORIZED channel to the one thing on the
box that hands out scanout dma-bufs. F_DUPFD_CLOEXEC instead. Measured the
difference rather than assuming it: dup() leaves FD_CLOEXEC clear,
F_DUPFD_CLOEXEC sets it.

Also the last two artifact sources without the stub check:

- --package + --drm stages the .so straight out of a bundle somebody else
  produced, with no _assert_so_has_egl. Third source, same exposure as
  DRMTAP_PREBUILT_DIR, now asserted like the other two. All three artifact
  paths are covered.
- the workflow triggers omitted src/server.rs, src/server/input_service.rs and
  src/platform/linux.rs, which all carry DRM wiring (warm_availability, the
  cursor path in run_cursor, the producer start and get_cursor/get_cursor_data),
  so a PR touching only those skipped the entire drm verification. Added to
  BOTH mirrored lists and asserted equal (15 == 15).

build.py

@@ -643,6 +643,11 @@ def build_deb_from_folder(version, binary_folder, want_drm=False):
             'build it deliberately)')
     if ships_so:
         so = _single_real_so(bundled_glob, 'the staged --drm bundle')
+        # The THIRD artifact source, and the last one that was missing the check: --package takes the
+        # .so straight out of a bundle somebody else produced, so it has the same exposure as
+        # DRMTAP_PREBUILT_DIR (see the comment on that branch). A CPU-only stub would ship, the loader
+        # would accept it, and capture would degrade to PipeWire without a word.
+        _assert_so_has_egl(so)
         stage_libdrmtap_into_deb(so)
         system2(f'rm -f {so}')
         system2('rm -f tmpdeb/usr/share/rustdesk/libdrmtap.so tmpdeb/usr/share/rustdesk/libdrmtap.so.0')