KU-P1: decrypt the real-unit test through test_util::decrypt_unit

aacs::content::decrypt_unit becomes pub(crate) at KU-X2 (keys-upfront design
v3.4 §2.2); the ignored real-unit test now uses the test-util door. The
feature comes in as a dev-dependency (resolved through the sibling path patch).

Cargo.toml

@@ -34,6 +34,11 @@ tracing = "0.1"
 # `set_last_decode_reachability`, for consumers' tests only (enable in dev-dependencies).
 test-hooks = []
 
+[dev-dependencies]
+# `test_util` fixtures (`decrypt_unit`, …) for this crate's tests (keys-upfront
+# KU-P1). CI resolves it through the sibling path patch.
+libfreemkv = { version = "1.7", features = ["test-util"] }
+
 [profile.release]
 lto = "thin"
 codegen-units = 1

src/keydb_format.rs

@@ -2423,7 +2423,7 @@ mod tests {
         for entry in &candidate_entries {
             for (_, key) in &entry.unit_keys {
                 let mut unit = original.clone();
-                libfreemkv::aacs::content::decrypt_unit(&mut unit, key);
+                libfreemkv::test_util::decrypt_unit(&mut unit, key);
                 attempts += 1;
                 any_key_changed_the_unit |= unit != original;
                 if libfreemkv::aacs::content::is_clean(&unit, libfreemkv::disc::ContentFormat::BdTs)