Sanitize GUI loader and plugin environment variables before privileged initialization, failing closed when the environment cannot be cleaned.
Retain CAP_SYS_ADMIN only on a dedicated DRM worker, route KMS and CUDA DRM access through it, reject queued work safely during overflow or shutdown, and drop the worker privileges when DRM access is no longer needed.
Add Linux regression coverage for the sanitizer and document the new privileged-worker interfaces.
Co-authored-by: Conn O'Griofa <749000+psyke83@users.noreply.github.com>
Co-authored-by: Kishi <41839133+Kishi85@users.noreply.github.com>
Dave Lane