drm: close the round-9 review findings

- strict mode on the remaining two assert steps of the drm workflow
  (the deb-contents assert and the glibc-floor measurement): same
  masking pattern as the .so contract step fixed last round - without
  set -e only the last command's status counts and the mid-script
  checks were decorative. the floor extraction gets an explicit rescue
  so a no-match grep still reaches the `test -n` reporter.
- the security doc states the whole accepted version window (exactly
  the pinned minor with a patch floor; a NEWER minor is refused too,
  because the mirrored struct layouts are only verified against the
  pinned one), and the auditing section carries the command matching
  its leftover-object comment.
- the uinput-missing warning literal lost the embedded space runs a
  reflow had left in it (it is the sole, once-per-process diagnostic
  for that failure and it read as a run-on line with gaps).
- the geometry-mismatch path in frame() hands the taken buffer back to
  the recycler before erroring; dropping it made every rebuild cycle
  re-allocate a scanout-sized buffer.

src/ipc/drm.rs

@@ -507,7 +507,10 @@ fn drm_wake_displays(reason: &str) -> bool {
             // would log the same failure forever.
             DRM_WAKE_UNAVAILABLE.store(true, Ordering::Relaxed);
             log::warn!(
-                "drm: cannot wake displays ({reason}): no uinput device ({err}). A compositor that                  disabled its outputs will keep them disabled, so there is no scanout to capture                  until something else generates input. Note input injection needs uinput too, so                  this session cannot control the host either."
+                "drm: cannot wake displays ({reason}): no uinput device ({err}). A compositor that \
+                 disabled its outputs will keep them disabled, so there is no scanout to capture \
+                 until something else generates input. Note input injection needs uinput too, so \
+                 this session cannot control the host either."
             );
             return false;
         }

src/server/drm_capturer.rs

@@ -454,6 +454,11 @@ impl TraitCapturer for IpcDrmCapturer {
                 // would leave only the rapid-rebuild guard to catch it, several seconds later and
                 // under a message about a change that never happened.
                 if self.session_size.is_some_and(|(sw, sh)| (w, h) != (sw, sh)) {
+                    // Hand the buffer back for recycling before erroring out: the receive path is
+                    // still alive until it observes this session ending, and this is a
+                    // scanout-sized allocation the recycler exists to keep. Dropping it here made
+                    // every rebuild cycle re-allocate one.
+                    self.shared.slot.lock().unwrap().free = Some(buf);
                     if !self.got_frame {
                         self.note_session_without_frame();
                     }