drm: make an unpinned libdrmtap deliberate, and reject --drm off Linux

Three ways to build a different libdrmtap than the pinned one (DRMTAP_REPO,
DRMTAP_SHA, DRMTAP_PREBUILT_DIR) were each silent, and the last skips the
sha verification entirely. The claim this feature rests on is that the
privileged capture library is the reviewed object at the pinned sha, so any
build that is not that one now has to say so: the overrides still work and
still cover local work and cross-builds, but they need
DRMTAP_ALLOW_UNPINNED=1 alongside them and the build prints what it did.

--drm on Windows or macOS was accepted and then dropped by get_features(),
so it produced a stock build that looked like a DRM one. Reject it.

Also test the _drm body-read deadline, which nothing exercised: the header
and the body are separate reads, so the caller budget does not cover the
second one and a regression there would silently reopen the stall.

src/ipc/drm.rs

@@ -1686,6 +1686,30 @@ mod drm_conn_tests {
         );
     }
 
+    // A header announcing a body that never arrives must not park the receive loop forever. The
+    // header and the body are two separate reads, so the caller's own per-message budget does not
+    // cover the second one; DRM_BODY_TIMEOUT_MS is what bounds it. This waits out the real deadline
+    // rather than a paused clock (tokio's test-util feature is not enabled here), which costs
+    // DRM_BODY_TIMEOUT_MS on a thread the rest of the suite is not waiting on.
+    #[tokio::test]
+    async fn a_body_that_never_arrives_times_out() {
+        let (mut a, b) = tokio::net::UnixStream::pair().unwrap();
+        let mut rx = DrmConn::new(b);
+        // Announce ten bytes and send none of them. `a` is kept alive, so this is a stall and not
+        // the EOF the read path already handles.
+        a.write_all(&10u32.to_be_bytes()).await.unwrap();
+        let mut got = Vec::new();
+        let err = rx
+            .next_raw_into(&mut got)
+            .await
+            .err()
+            .expect("a body that never arrives must time out");
+        assert!(
+            err.to_string().contains("did not arrive"),
+            "unexpected error: {err}"
+        );
+    }
+
     // A peer that packs more than one fd into a single SCM_RIGHTS cmsg (the safe API never does) must
     // not smuggle extra fds into the consumer: drm_recvmsg keeps the FIRST and closes the rest. The
     // frame otherwise decodes normally and the kept fd is the first one sent. (Two fds fit the control