Preserve display assignments and fix CI checks

Keep surviving outputs on their applied CRTCs when enabling another display. Reserve nested IPC directories with explicit private permissions and cover session umasks.

Separate compositor checks from release-only workspace checks, provide test runtime prerequisites, and correct the reload test's initial revision assumption.

compositor/src/reload.rs

@@ -435,6 +435,7 @@ mod tests {
             } else {
                 std::fs::remove_file(&path).unwrap();
             }
+            let already_applied = state.config_source.as_deref() == Some(valid);
             let before = state.theme_engine.revision;
             let (reply, received) = std::sync::mpsc::sync_channel(1);
             state.queue_config_reload(index == 1, Some((42, reply))).unwrap();
@@ -453,7 +454,8 @@ mod tests {
                 Duration::from_millis(200)
             );
             assert_eq!(state.config_source.as_deref(), Some(valid));
-            if source == Some(valid) && before > 0 {
+            // An initial revision can describe defaults rather than this source.
+            if source == Some(valid) && already_applied {
                 assert_eq!(state.theme_engine.revision, before);
             }
         }