drm: build the unattended-wayland deb in its own workflow, not in the release job

flutter-build.yml goes back to upstream byte for byte. Three separate changes to
the stock release path disappear with it: the drm variant built inside the release
container, the snapshot and restore of the stock flutter bundle that existed only
to keep the drm relink out of the archlinux package, and the narrowing of the
publish glob to keep the consent-free deb off the public release.

The deb now builds in the drm workflow instead, which also removes the failure
mode the old placement forced: the whole block had to run in a subshell ending in
`|| echo WARN` so a drm-only breakage could not abort the stock publish steps,
which meant every failure in it, from the fetch to meson to packaging, kept the
job green and silently stopped producing the deb. A separate job can just fail.

The bridge generator is a reusable workflow, so this calls the stock one rather
than duplicating the codegen.

The deb is asserted rather than trusted: build.py can exit 0 without producing a
package, so the job checks the file exists and that it carries both the real
libdrmtap object and its soname symlink. It stays an artifact and never a release
deliverable, and it is built on the runner rather than in the old container the
stock debs use, so its glibc floor is higher than a released package.

.github/workflows/drm-capture.yml

@@ -39,6 +39,7 @@ on:
 env:
   VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
   VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
+  FLUTTER_VERSION: "3.24.5"
 
 jobs:
   drm-tests:
@@ -157,3 +158,105 @@ jobs:
           done
           test "$missing" -eq 0
           echo "::notice::libdrmtap .so contract ok (13 loader symbols, EGL detile present)"
+
+  # The bridge generator is a reusable workflow, so this calls the stock one instead of duplicating it.
+  generate-bridge:
+    uses: ./.github/workflows/bridge.yml
+
+  drm-deb:
+    name: unattended-wayland deb (verification build)
+    needs: generate-bridge
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: false
+          swap-storage: false
+
+      - name: Checkout source code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          submodules: recursive
+
+      - name: Restore bridge files
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bridge-artifact
+          path: ./
+
+      - name: Install prerequisites
+        shell: bash
+        run: |
+          sudo apt-get -y update
+          # Same list the stock linux job needs, plus the flutter desktop toolchain and the three
+          # libdrmtap build deps (libdrm and the mesa-specific EGL/GLES dev packages).
+          sudo apt-get install -y \
+            clang cmake curl gcc git g++ ninja-build meson pkg-config \
+            libpam0g-dev libasound2-dev libunwind-dev liblzma-dev \
+            libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
+            libgtk-3-dev libpulse-dev libva-dev libvdpau-dev \
+            libxcb-randr0-dev libxcb-shape0-dev libxcb-xfixes0-dev \
+            libxdo-dev libxfixes-dev nasm wget \
+            libdrm-dev libegl1-mesa-dev libgles2-mesa-dev
+
+      - name: Setup vcpkg with Github Actions binary cache
+        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
+        with:
+          vcpkgDirectory: /opt/artifacts/vcpkg
+          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
+
+      - name: Install vcpkg dependencies
+        shell: bash
+        run: $VCPKG_ROOT/vcpkg install --x-install-root="$VCPKG_ROOT/installed"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+          targets: x86_64-unknown-linux-gnu
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+      - name: Setup flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        with:
+          channel: "stable"
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+
+      - name: Patch flutter
+        shell: bash
+        run: |
+          cd $(dirname $(dirname $(which flutter)))
+          [[ "3.24.5" == ${{ env.FLUTTER_VERSION }} ]] && git apply ${{ github.workspace }}/.github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff
+
+      - name: Build the unattended-wayland deb
+        shell: bash
+        run: |
+          cargo build --locked --lib --release --features hwcodec,flutter,unix-file-copy-paste,drm
+          python3 ./build.py --flutter --drm --skip-cargo
+
+      # build.py exits 0 on some inner failures, so assert the artifact instead of trusting the status,
+      # and assert the two things that make it the drm variant at all.
+      - name: Assert the deb is a real drm build
+        shell: bash
+        run: |
+          deb="$(ls rustdesk-unattended-wayland-*.deb)"
+          test -n "$deb"
+          echo "::notice::built $deb ($(stat -c %s "$deb") bytes)"
+          dpkg -c "$deb" | grep -E 'usr/lib/rustdesk/libdrmtap\.so\.0\.[0-9]+\.[0-9]+$'
+          dpkg -c "$deb" | grep -E 'usr/lib/rustdesk/libdrmtap\.so\.0 ->'
+          mv "$deb" "${deb%.deb}-x86_64.deb"
+
+      # Verification artifact, deliberately NOT a release deliverable: it is built on the runner rather
+      # than in the old container the stock release debs use, so its glibc floor is higher. The consent
+      # free variant stays out of the published release either way.
+      - name: Upload the deb
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: rustdesk-unattended-wayland-x86_64.deb
+          path: rustdesk-unattended-wayland-*-x86_64.deb