drm: close the round-10 review findings

- the /dev/dri gate returns the CANONICAL path instead of a bool, and
  both callers open that value. answering yes/no meant the caller
  handed the original string to libdrmtap, which re-resolved every
  symlink component after the check - a check-then-use window, in the
  root service. this is the whole point of the gate, so it should
  never have been able to hand back an unresolved path.
- `--package <folder> --drm` builds the capture library instead of
  demanding it inside the bundle. no build path puts libdrmtap in a
  bundle folder (the flutter deb builds it straight into the staged
  deb), so that check made the flag combination impossible to satisfy.
  the safety property it stood in for is now asserted directly and
  better: the staged BINARY must carry the drm dlopen path, so a stock
  binary can never be packaged under the consent-bypass name. a bundle
  that does carry a .so keeps its existing EGL assertion, and the
  variant naming keys on the explicit request rather than on what
  happened to be staged.
- the deb assert step globs into an array and asserts the count: under
  set -e `ls` aborted before its own `test -n` could report, and
  several matches produced a multi-line value whose mv failed with an
  unrelated error.

.github/workflows/drm-capture.yml

@@ -323,8 +323,16 @@ jobs:
           # Strict mode so the mid-script checks can fail the step (without it only the LAST
           # command's status counts and the greps above it are decorative).
           set -euo pipefail
-          deb="$(ls rustdesk-unattended-wayland-*.deb)"
-          test -n "$deb"
+          # Glob into an array and assert the COUNT. `deb="$(ls ...)"` aborted on zero matches
+          # before its own `test -n` could report, and on several matches produced a multi-line
+          # value whose `mv` failed with something unrelated to the real problem.
+          shopt -s nullglob
+          debs=(rustdesk-unattended-wayland-*.deb)
+          if [ "${#debs[@]}" -ne 1 ]; then
+            echo "::error::expected exactly one rustdesk-unattended-wayland-*.deb, found ${#debs[@]}: ${debs[*]-none}"
+            exit 1
+          fi
+          deb="${debs[0]}"
           echo "::notice::built $deb ($(stat -c %s "$deb") bytes)"
           dpkg -c "$deb" | grep -E 'usr/lib/rustdesk/libdrmtap\.so\.0\.[0-9]+\.[0-9]+$'
           dpkg -c "$deb" | grep -E 'usr/lib/rustdesk/libdrmtap\.so\.0 ->'