Restore AACS PK key-processing path in keysources

unit_keys_from now resolves the Media Key in order: stored per-disc MK
-> keydb Processing Key pool (mk_from_pk vs this disc's own MKB) ->
device-key pool (mk_from_dk), then MK+VID -> VUK -> UK. MK/VUK entries
still honored directly; cross-disc MK-pool brute stays retired. Fixes the
factually-wrong justifying comment + adds PK-pool KATs.

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## [1.1.0-beta.1] — UNRELEASED
+
+### Fixed
+
+- **Processing-Key decryption restored.** A keydb Processing Key is again driven
+  through the full AACS chain — PK → Media Key (against this disc's own MKB) →
+  Volume Unique Key (with the disc Volume ID) → unit keys — so discs that ship
+  only a Processing Key decrypt again. Stored Media Keys and Volume Unique Keys
+  are still honored directly. (Cross-disc Media-Key reuse remains intentionally
+  disabled.)