fix(linux/xdgportal): Improve multi-monitor support and work around breaking kmsgrab

[Kishi85]

Description

Follow up to #4931 that adds a few safety checks to selected pipewire streams and also re-adds the stream sorting by position that was lost during the final commit restructuring of said PR.

It also changes how finalizing portal security is done (dropping CAP_SYS_ADMIN + setting PR_DUMPABLE) to not break kmsgrab by dropping capabilties as before #4931.

Screenshot

Issues Fixed or Closed

• Fixes Can't find GPU or display after latest update version 2026.409.171120 #4968

Roadmap Issues

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[Kishi85]

@ReenigneArcher would be great to see this in ASAP as I've managed to accidentally remove the stream sorting in my final commit re-structure on #4931 and now the streams are random in the order coming from the portal.

This might also help identifying the issues in #4968

[Kishi85]

Now also fixes kmsgrab by not dropping CAP_SYS_ADMIN earlier than before #4931.

[Kishi85]

@psyke83 Could you Cross-Check if I've missed anything in 4fbad45 ? Looks good on my end for all the usual test cases from #4931 and the issue with probing.

[psyke83]

@Kishi85

Can confirm this resolves the issue with kmsgrab failing to initialize when probed via default capture = auto (or capture unset) case. Aside from that, multi-monitor still looks to be working fine on KDE (GNOME not working is expected), and resolution change + XDG stop still works fine on both KDE and GNOME. Tested with the problematic system_tray = disabled setting and everything is still working fine.

I was thinking that finalize_portal_security() may be better suited with a more generic name and moved to a platform function in misc.cpp just in case other/future capture methods also need dropped capabilities, but that's not important right now, or relevant to this PR. Looks good to me.

[ReenigneArcher]

There are clang format issues in this PR. Don't worry, it's easy to fix.

1. Create and activate a python venv in your workspace (optional) - https://docs.python.org/3/library/venv.html#creating-virtual-environments

2. Install dependencies with the following command:

   python -m pip install ".[lint]"

3. Run the following command to fix lint issues:

   python scripts\update_clang_format.py

[codecov]

Bundle Report

Bundle size has no change ✅

[Kishi85]

Linter issues should be fixed now. Sorry for the inconvinience!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 17.02128% with 39 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (master@58d3c37). Learn more about missing BASE report.
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/platform/linux/portalgrab.cpp	17.02%	36 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #4969   +/-   ##
=========================================
  Coverage          ?   17.99%           
=========================================
  Files             ?      108           
  Lines             ?    23420           
  Branches          ?    10337           
=========================================
  Hits              ?     4215           
  Misses            ?    16799           
  Partials          ?     2406           

Flag	Coverage Δ
Archlinux	11.60% <0.00%> (?)
FreeBSD-14.3-amd64	13.60% <18.75%> (?)
Homebrew-ubuntu-22.04	13.92% <0.00%> (?)
Linux-AppImage	12.22% <17.07%> (?)
Windows-AMD64	14.90% <ø> (?)
Windows-ARM64	13.23% <ø> (?)
macOS-arm64	19.02% <ø> (?)
macOS-x86_64	18.39% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/platform/linux/portalgrab.cpp	4.66% <17.02%> (ø)

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 58d3c37...1b88786. Read the comment docs.