daemon: replace exit(1) callbacks with recoverable state machine

[silentone12725]

Summary

This PR changes the wrapper from a process that terminates on Apple playback lease errors into a long-running, self-recovering daemon.

Previously, both SVPlaybackLeaseManager callbacks (endLeaseCb and pbErrCb) called exit(1) unconditionally. A lease termination therefore killed the entire wrapper, requiring an external supervisor to restart the process.

The new implementation keeps the wrapper and its HTTP services alive, moves FairPlay context reacquisition into a dedicated recovery worker, makes access to the shared decryption context thread-safe, exposes lifecycle state to external consumers, and brings the rootless wrapper in line with the same recovery model.

It also adds build/drift tooling to help keep the C and rootless wrapper implementations synchronized.

---

What changed

Recovery state machine

main.cpp now maintains an explicit recovery lifecycle:

• Running
• Scheduled
• Refreshing
• Failed

get_recovery_state() is exported as an extern "C" API so external consumers can observe the daemon state:

Value	State
0	Running
1	Scheduled
2	Refreshing
3	Failed

is_recovery_active() provides a simple recovery gate for request handlers.

Non-blocking lease callbacks

endLeaseCb and pbErrCb no longer perform recovery work or terminate the process directly.

Instead, callbacks enqueue a recovery event and return immediately.

This keeps FairPlay/library calls out of the lease-manager callback context and reduces the risk of callback reentrancy or deadlocks.

Dedicated recovery worker

Recovery is handled by a persistent worker thread that owns context reacquisition.

The worker:

• drains and coalesces queued lease events before each recovery attempt;
• performs one refresh for a burst of related errors instead of repeatedly refreshing for every callback;
• calls refresh_decrypt_ctx() as the single owner of reacquisition;
• verifies recovery using is_preshare_ctx_ready();
• resets the consecutive-failure counter only after a usable preshareCtx exists; and
• schedules its own retry after a failed refresh, so recovery continues even when Apple sends no additional lease event.

Retry delay uses bounded exponential backoff:

1s -> 2s -> 5s -> 10s -> 30s

The 30-second delay is clamped rather than terminating recovery, allowing the daemon to survive prolonged transient failures.

Thread-safe FairPlay context access

main.c now protects preshareCtx with a PTHREAD_MUTEX_INITIALIZER-backed mutex.

All relevant reads and writes are synchronized between the decrypt path and the recovery worker.

The mutex is deliberately released before FairPlay/network reacquisition work so long-running recovery operations do not hold the context lock.

is_preshare_ctx_ready() also checks the context while holding the mutex.

Request gating during recovery

Decrypt and M3U8 request handling now checks the recovery state before using the FairPlay context.

During recovery:

• the decrypt endpoint returns immediately/EOF;
• the M3U8 endpoint returns an empty response and continues serving subsequent requests; and
• key-delivery work is prevented from racing context reacquisition.

The decrypt, M3U8, and account servers themselves remain running throughout lease recovery.

External supervision is therefore reserved for actual process failures such as crashes, OOM termination, or other unrecoverable failures rather than normal lease lifecycle events.

---

DRM lifecycle state

The wrapper now publishes its lifecycle through:

<base-dir>/drm-state

The state file allows the surrounding Go/Electron layer to observe wrapper lifecycle changes without inferring state solely from process existence.

Lifecycle states include:

• STARTING
• LOGIN
• WAITING_2FA
• INITIALIZING_FAIRPLAY
• RUNNING
• RECOVERY
• FAILED
• STOPPED

This provides a lightweight interface for status reporting and supervisor integration while keeping recovery ownership inside the wrapper.

---

Rootless wrapper

wrapper-rootless.c has been updated to follow the persistent-daemon recovery model rather than treating lease termination as an unconditional process-exit condition.

This keeps rootless operation aligned with the recovery behavior introduced in the main wrapper implementation.

---

Build and drift protection

This PR also adds tooling around the wrapper build:

• adds Dockerfile.build for a reproducible wrapper build environment;
• adds scripts/check-drift.py;
• runs the wrapper drift check from the x86_64 GitHub Actions workflow.

The drift check is intended to catch unintended divergence between related wrapper implementations as recovery/lifecycle behavior evolves.

---

Result

Before

Apple lease error
       |
       v
 endLeaseCb / pbErrCb
       |
       v
     exit(1)
       |
       v
 wrapper process dies
       |
       v
 external supervisor must restart it

After

Apple lease error
       |
       v
 endLeaseCb / pbErrCb
       |
       v
 enqueue recovery event
       |
       v
 callback returns immediately
       |
       v
 recovery worker
       |
       +--> coalesce events
       |
       +--> refresh FairPlay context
       |
       +--> success --> RUNNING
       |
       `--> failure --> backoff --> retry

The wrapper therefore behaves as a persistent service: lease expiration and transient FairPlay recovery failures are handled internally, while the process and HTTP servers remain alive.

Commits

This PR consists of two logical changes:

1. daemon: replace exit(1) callbacks with recoverable state machine

   • recovery state machine
   • asynchronous recovery worker
   • retry/backoff behavior
   • context synchronization
   • request gating

2. Add DRM state tracking and wrapper drift check

   • lifecycle state publication
   • rootless wrapper updates
   • build tooling
   • wrapper drift validation and CI integration