drm: close the round-17 review findings

- the scanout dma-buf fd is duplicated with F_DUPFD_CLOEXEC. `dup(2)`
  never copies close-on-exec, so this fd was inherited by every child
  the ROOT service forks (it forks synchronously for the loginctl
  active-uid lookup) - and what this fd names is the live screen
  contents. this is the SAME defect already closed on the `_drm`
  socket fd in ipc/drm.rs; fixing that one and not grepping for the
  siblings is how this survived. there is exactly one dup in the drm
  path now and it is this one, verified by grep. measured that
  F_DUPFD_CLOEXEC sets FD_CLOEXEC and preserves the O_RDONLY access
  mode the read-only export depends on; SCM_RIGHTS delivery is
  unaffected since the receiver gets its own descriptor.
- Desktop::refresh resolves HOME on the login-Wayland path too, since
  the drm build now starts a --server as the greeter uid there and a
  child with no HOME has nowhere to put its config. the compositor
  variables stay blank deliberately: the drm path talks to the root
  service and a render node, never to the compositor or the portal,
  which is why it works at a login screen at all. reasoned, not
  measured: a current GDM runs its greeter as `gdm-greeter`, which
  `is_gdm_user` does not match, so that path is not reachable on our
  hardware - measured there, the greeter server gets a fully populated
  environment through the branch below.
- the glibc-floor step globs into an array and asserts the count, like
  its sibling assert step. that sibling was fixed two rounds ago and
  this one was left behind.

libs/scrap/src/common/drm_reader.rs

@@ -440,11 +440,20 @@ impl DrmReader {
             }
             // dup the fd into an OwnedFd BEFORE releasing the frame: after release
             // the library may recycle its handle, but our dup (an independent fd on
-            // the same open dma-buf) keeps the buffer alive for the peer. dup(2)
-            // shares the same open file description, so it preserves the O_RDONLY
-            // access mode of libdrmtap's exported scanout fd (DRM_RDWR dropped) --
-            // the peer's fd stays read-only and cannot write the live scanout.
-            let dup_fd = hbb_common::libc::dup(raw_fd);
+            // the same open dma-buf) keeps the buffer alive for the peer. It shares
+            // the same open file description, so it preserves the O_RDONLY access
+            // mode of libdrmtap's exported scanout fd (DRM_RDWR dropped) -- the
+            // peer's fd stays read-only and cannot write the live scanout.
+            //
+            // F_DUPFD_CLOEXEC, not dup(): `dup` never copies the close-on-exec flag, so this fd
+            // would be inherited by every child this process forks. This runs in the ROOT service,
+            // which does fork synchronously elsewhere (the `loginctl` active-uid lookup), and what
+            // this fd names is the LIVE SCANOUT -- the screen contents. Leaking that into an
+            // unrelated child is a disclosure even if no child ever reads it. Same fix, same
+            // reason, as `dup_to_drm_conn` in ipc/drm.rs, which closed this on the socket fd; this
+            // was its sibling and the one that carries the pixels. SCM_RIGHTS delivery is
+            // unaffected: the receiver gets its own descriptor with its own flags.
+            let dup_fd = hbb_common::libc::fcntl(raw_fd, hbb_common::libc::F_DUPFD_CLOEXEC, 0);
             if dup_fd < 0 {
                 let e = io::Error::last_os_error();
                 (self.lib.frame_release)(self.ctx, &mut frame);