drm: close the round-9 review findings

- strict mode on the remaining two assert steps of the drm workflow
  (the deb-contents assert and the glibc-floor measurement): same
  masking pattern as the .so contract step fixed last round - without
  set -e only the last command's status counts and the mid-script
  checks were decorative. the floor extraction gets an explicit rescue
  so a no-match grep still reaches the `test -n` reporter.
- the security doc states the whole accepted version window (exactly
  the pinned minor with a patch floor; a NEWER minor is refused too,
  because the mirrored struct layouts are only verified against the
  pinned one), and the auditing section carries the command matching
  its leftover-object comment.
- the uinput-missing warning literal lost the embedded space runs a
  reflow had left in it (it is the sole, once-per-process diagnostic
  for that failure and it read as a run-on line with gaps).
- the geometry-mismatch path in frame() hands the taken buffer back to
  the recycler before erroring; dropping it made every rebuild cycle
  re-allocate a scanout-sized buffer.

.github/workflows/drm-capture.yml

@@ -320,6 +320,9 @@ jobs:
       - name: Assert the deb is a real drm build
         shell: bash
         run: |
+          # Strict mode so the mid-script checks can fail the step (without it only the LAST
+          # command's status counts and the greps above it are decorative).
+          set -euo pipefail
           deb="$(ls rustdesk-unattended-wayland-*.deb)"
           test -n "$deb"
           echo "::notice::built $deb ($(stat -c %s "$deb") bytes)"
@@ -335,10 +338,14 @@ jobs:
         id: floor
         shell: bash
         run: |
+          # Strict mode for the same reason as the assert step above. The floor extraction gets an
+          # explicit rescue so a no-match grep reaches the `test -n` reporter instead of dying as a
+          # bare pipeline failure.
+          set -euo pipefail
           deb="$(ls rustdesk-unattended-wayland-*-x86_64.deb)"
           rm -rf /tmp/debfloor && dpkg-deb -R "$deb" /tmp/debfloor
           floor="$(objdump -T /tmp/debfloor/usr/share/rustdesk/lib/librustdesk.so \
-                   | grep -oE 'GLIBC_2\.[0-9]+' | sort -uV | tail -1)"
+                   | grep -oE 'GLIBC_2\.[0-9]+' | sort -uV | tail -1 || true)"
           test -n "$floor"
           echo "floor=${floor#GLIBC_}" >> "$GITHUB_OUTPUT"
           echo "::notice::deb requires ${floor} or newer (built on the runner, not the ubuntu18.04 release container)"