feat: integrate security-loader and FIFO-based lifecycle management for dde-update

[xujin177]

feat: integrate security-loader and FIFO-based lifecycle management for dde-update

1. Add securityloaderhelper for D-Bus authorization handshake with deepin-security-loader when launched through the security framework
2. Introduce FifoNotifier RAII helper to notify the launching script when the process exits, covering all return paths from main()
3. Add wrapper script /usr/bin/dde-update for FIFO creation, PID tracking, watchdog fallback, and blocking exit notification via --wait mode
4. Add launch-dde-update intermediate script for kwin --exit-with- session compatibility, forwarding --wait to the wrapper
5. Move binary installation path from /usr/bin to /usr/libexec/ deepin for security-loader integration
6. Update ExecPath in 99_system_upgrade_conf.json to reflect the new installation path
7. Update Wayland session script to use the new launch-dde-update wrapper
8. Add org.deepin.dde-update.json D-Bus permission configuration for Lastore interface access
9. Register --fd1/--fd2 and --notify-fifo CLI options to support security-loader injection and exit notification

Log: Add security-loader support with FIFO-based process lifecycle management for dde-update

Influence:

1. Test dde-update launch without security-loader (normal startup path)
2. Test dde-update launch with security-loader (authorization handshake)
3. Verify FIFO exit notification works (covers all exit paths including crashes)
4. Test watchdog fallback when dde-update is killed without EXIT notification (SIGKILL/SEGV)
5. Verify wrapper cleanup (temp directory removal, fd closing, watchdog termination)
6. Test kwin --exit-with-session flow via launch-dde-update on Wayland
7. Verify configuration file changes do not break existing update functionality
8. Test upgrade check flow in both X11 and Wayland sessions

feat: 集成 security-loader 和基于 FIFO 的生命周期管理

1. 添加 securityloaderhelper，实现在通过安全框架启动时的 D-Bus 授权 握手
2. 引入 FifoNotifier RAII 辅助类，在进程退出时通知启动脚本，覆盖所有 main() 返回路径
3. 添加包装脚本 /usr/bin/dde-update，通过 --wait 模式实现 FIFO 创 建、PID 跟踪、看门狗兜底和阻塞退出通知
4. 添加 launch-dde-update 中间脚本，兼容 kwin --exit-with-session 调 用方式，透传 --wait 给包装脚本
5. 将二进制安装路径从 /usr/bin 改为 /usr/libexec/deepin，以便与 security-loader 集成
6. 更新 99_system_upgrade_conf.json 中的 ExecPath，使其指向新安装路径
7. 更新 Wayland 会话脚本，改用新的 launch-dde-update 包装脚本
8. 添加 org.deepin.dde-update.json D-Bus 权限配置文件，用于 Lastore 接 口访问
9. 注册 --fd1/--fd2 和 --notify-fifo 命令行选项，支持 security- loader 注入和退出通知

Log: 新增 security-loader 支持和基于 FIFO 的进程生命周期管理

Influence:

1. 测试不经过 security-loader 启动 dde-update（正常启动路径）
2. 测试经过 security-loader 启动 dde-update（授权握手流程）
3. 验证 FIFO 退出通知功能正常工作（覆盖所有退出路径，包括崩溃）
4. 测试 dde-update 被杀死时看门狗兜底机制（SIGKILL/SEGV 等无 EXIT 通知的 场景）
5. 验证包装脚本清理工作（临时目录删除、文件描述符关闭、看门狗终止）
6. 测试 Wayland 下通过 launch-dde-update 的 kwin --exit-with-session 流程
7. 验证配置文件变更不会破坏现有更新功能
8. 测试 X11 和 Wayland 会话下的升级检查流程

PMS: TASK-370161

[sourcery-ai]

Sorry @xujin177, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: xujin177

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

Hi @xujin177. Thanks for your PR.

I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.