drm: tighten the render-node count and the loader diagnostics

Four corrections from a review pass over the previous two commits.

Count only a render node whose name is renderD followed by a numeric minor.
The prefix test also matched something like renderD.backup, which would have
inflated the count and pushed a genuinely single-GPU host onto the CPU path.

Log the load only after every required symbol resolved. load() still returns
None when one is missing, so announcing success first could print "libdrmtap
loaded" and then "libdrmtap not available" for the same library.

Name only the capability each absent symbol costs: a library missing just
drmtap_render_node loses exporting-GPU selection, one missing just
drmtap_list_devices loses multi-GPU enumeration, and the previous wording
claimed both were gone in either case.

Fix the security document's audit step. The dlopen names the symlink by
absolute path and the package registers no linker directory, so a leftover
object beside it is not loaded on its own; what matters is where the symlink
points, and a leftover only matters as what a stray ldconfig would repoint it
to. Ask the auditor to read the symlink target instead.

src/server/drm_capturer.rs

@@ -132,9 +132,13 @@ fn render_node_count() -> usize {
         entries
             .filter_map(|e| e.ok())
             .filter(|e| {
+                // `renderD` plus a numeric minor, so a stray `renderD.backup` or `renderDfoo` cannot
+                // inflate the count and push a genuinely single-GPU host onto the CPU path.
                 e.file_name()
                     .to_str()
-                    .map_or(false, |n| n.starts_with("renderD"))
+                    .and_then(|n| n.strip_prefix("renderD"))
+                    .and_then(|minor| minor.parse::<u32>().ok())
+                    .is_some()
             })
             .count()
     })