drm: close the round-13 review findings

- the ABI refusal message has a branch for an unverified MINOR. It had
  only two, so a library NEWER than the pinned minor was told it
  "predates the split-capture API" - the opposite of its problem, and
  the kind of message that sends someone looking in the wrong place.
  the warn line names the accepted minor too.
- the libdrm floor no longer claims 18.04 ships 2.4.101: base bionic
  shipped 2.4.91, which is BELOW the 2.4.95 the GetFB2 API needs, and
  only the updates/HWE stack clears it. read as "18.04 with updates,
  or newer".
- the drm-build marker scan reads the staged binaries chunked inside a
  `with`, overlapping by len(marker)-1 so a marker cannot fall across
  a chunk boundary, instead of pulling a 45 MB librustdesk.so into
  memory and leaning on refcounting to close the file. verified
  against a real drm build (found) and an unrelated binary (not
  found).

libs/scrap/src/common/drmtap_dl.rs

@@ -287,6 +287,15 @@ impl DrmtapLib {
                 let why = if major != DRMTAP_ABI_MAJOR {
                     "the struct layouts this build mirrors track the ABI major, so reading a \
                      frame descriptor through a mismatched one would mis-decode it"
+                } else if minor != DRMTAP_ABI_MINOR {
+                    // A NEWER minor lands here too, and telling its user the library "predates the
+                    // split" would send them looking for the wrong problem. Under 0.x semver the
+                    // minor is the breaking axis, and the structs this file mirrors are not frozen,
+                    // so an unverified minor could be read at the wrong offsets.
+                    "this build mirrors the struct layouts of one minor and only that one; \
+                     under 0.x semver the minor is the breaking axis, so an unverified minor \
+                     could be read at the wrong offsets. Widening it is a deliberate act, done \
+                     with the layouts re-checked field by field"
                 } else {
                     "it predates the split-capture API, so its only capture path converts \
                      in-process, which in the root service means loading the GL stack there"
@@ -294,7 +303,7 @@ impl DrmtapLib {
                 let (min_minor, min_patch) = DRMTAP_MIN_MINOR_PATCH;
                 log::warn!(
                     "libdrmtap {name} reports v{major}.{minor}.{patch}, which this build cannot \
-                     use (needs ABI major {DRMTAP_ABI_MAJOR}, at least \
+                     use (needs ABI major {DRMTAP_ABI_MAJOR}, minor {DRMTAP_ABI_MINOR}, at least \
                      v{DRMTAP_ABI_MAJOR}.{min_minor}.{min_patch}): {why}. Refusing to load; \
                      falling back to PipeWire/portal."
                 );