fix(libfreemkv): rc6 hardening pass — mux timeline/colour/PCR, demux panic sentinel, parser robustness + doc accuracy

Surgical fixes (each with a regression test that fails without the change):

mux/mkv.rs, mux/demux_sink.rs: drive the clip-boundary timeline epoch
off the resolved PRIMARY VIDEO track, not the literal stream index 0.
An M2TS/PMT title can list an audio ES before video, so streams[0] may
be audio; a non-video epoch driver ratchets the frontier and inflates
the timeline. mkv cluster-opening falls back to track 0 for audio-only
titles so they still open clusters.

mux/codec/ac3.rs: correct ACMOD_CHANNELS — acmod=5 (3/1) is 4 channels,
not 3 (was undercounting a 3/1 stream); fix the A/52 Table 5.8 doc.

disc/mod.rs: HDMV coding_type 0x91 (Interactive Graphics / menus) no
longer maps to PGS subtitle — it falls through to Unknown so the PMT/STN
walker drops it instead of surfacing a bogus subtitle track.

mux/videomap.rs + mux/mkv.rs: FVI colour now mirrors the MKV muxer's CICP
precedence (measured CICP authoritative; HDR-driven PQ/HLG transfer
override) via a shared cicp_for_video helper, so the two sinks can't
disagree (HDR10 BT.2020 no longer emits SDR transfer 14).

mux/mkvstream.rs: saturating_add on cluster_ts + rel_ts so an adversarial
CLUSTER_TIMESTAMP near i64::MAX can't overflow/panic before the existing
saturating_mul.

mux/timeline.rs: tighten the tail-straggler clamp so a normal new-epoch
non-video frame leading the sparse video frontier by >3s is not demoted
into the previous clip's epoch.

mux/m2ts_mux/mod.rs: re-stamp PCR per video TS packet (mid-PES), not only
at PES boundaries, so a large UHD I-frame can't open a multi-second PCR
gap; modular 33-bit PTS rebasing so a real 90 kHz clock wrap is not
collapsed to PTS 0 (pre-base frames still floor to 0).

io/byte_prefetcher.rs, sector/prefetched.rs: wrap the producer feed loop
in catch_unwind and emit a typed error sentinel on panic, so a mid-stream
producer panic is not read as a clean EOF at the demux boundary (which
would silently truncate the mux).

mux/codec/h264.rs: extend HIGH_PROFILES to the full ISO/IEC 14496-15 set
that mandates the avcC chroma/bit-depth extension (adds 244 et al.).

Doc/comment accuracy: css/mod.rs (50000 sectors, not scrambled-sectors),
aacs/decrypt.rs (decrypt_unit already-clear path), ifo.rs (TT_SRPT at
0xC4), css/lfsr.rs (LFSR0 24-bit; TAB1-then-XOR cipher; real scramble-flag
predicate), disc/read_error.rs (for_sweep does bounded transient retries).

Skipped: keydb.rs SSRF guard (low/latent, no live caller) — a hard
loopback block breaks an existing behavioral test that exercises the
header-EOF path over a loopback server; a clean fix needs a resolver test
seam beyond this surgical pass. The sibling keydb_fetch.rs comment fix is
out of scope (freemkv crate).

src/css/lfsr.rs

@@ -3,10 +3,13 @@
 //! The CSS cipher uses two table-driven feedback circuits:
 //! - LFSR1: 17-bit state (9-bit lo + 8-bit hi register, seeded from
 //!   key[0..2]), driven by TAB2/TAB3
-//! - LFSR0: 32-bit state, driven by a feedback polynomial through TAB4
+//! - LFSR0: 24-bit feedback register (seeded from key[2..5] XOR seed[2..5],
+//!   masked to 0xFFFFFF), driven by a feedback polynomial through TAB4
 //!
 //! The keystream is the bytewise sum (with carry) of both LFSR outputs.
-//! Content descrambling XORs this keystream with the encrypted sector data.
+//! Content descrambling computes plain = TAB1[cipher] ^ keystream — a TAB1
+//! substitution of each ciphertext byte followed by an XOR with the keystream
+//! (NOT a plain XOR; the cipher is not its own inverse).
 //!
 //! Algorithm: Frank A. Stevenson's divide-and-conquer attack (1999).
 //! Tables: CSS specification constants.
@@ -324,15 +327,15 @@ mod tests {
     // ── scramble-flag detection (byte 0x14, bits 4-5) ──────────────────────
 
     /// Only bits 4-5 of byte 0x14 are the CSS scramble flag: the code reads
-    /// `(sector[0x14] >> 4) & 0x03`. Bit 6 (0x40) and bit 7 (0x80) are NOT
-    /// part of the flag, so a sector with 0x14 == 0x40 or 0x80 must be treated
-    /// as UNSCRAMBLED and left byte-for-byte unchanged. This guards against a
+    /// `sector[0x14] & 0x30 == 0` (bits 6-7, i.e. 0x40/0x80, are masked out by
+    /// 0x30). A sector with 0x14 == 0x40 or 0x80 must therefore be treated as
+    /// UNSCRAMBLED and left byte-for-byte unchanged. This guards against a
     /// too-wide mask silently "descrambling" (and thus corrupting) clear data.
     ///
     /// Grounding: CSS sector header byte 0x14 — copyright/scramble bits live
-    /// in bits 4-5; the 2-bit value 0 means not scrambled.
-    /// Mutation: change `(sector[0x14] >> 4) & 0x03` to `& 0x07` or drop the
-    /// shift -> 0x40 would be seen as scrambled and the body would change.
+    /// in bits 4-5; the masked value 0 means not scrambled.
+    /// Mutation: widen the mask `0x30` to `0x70`/`0xF0` -> 0x40/0x80 would be
+    /// seen as scrambled and the body would change.
     #[test]
     fn descramble_treats_high_bits_of_0x14_as_clear() {
         let key = [0x01, 0x02, 0x03, 0x04, 0x05];

src/css/mod.rs

@@ -51,7 +51,7 @@ pub struct CssState {
 /// (bytes 0x00..0x80) often ends in a short-period repeating run (stuffing /
 /// constant fill); the attack assumes that run continues across the 0x80
 /// boundary into the encrypted region, giving the known plaintext the 2^16
-/// LFSR recovery needs. We scan up to 50000 scrambled sectors across the
+/// LFSR recovery needs. We scan up to 50000 sectors across the
 /// extents and return the first sector that yields a key — no player keys, no
 /// disc-key crack. Works on a live drive (after bus-auth unlocks reads) and on
 /// disc images alike.