0.31.0: hardening and correctness pass across mux, codec, AACS/CSS, UDF/MPLS/CLPI, recovery, drive/SCSI, labels, and I/O

Library-wide review-and-fix pass: tightened AACS keydb/handshake/variant
handling and trailing-partial-unit policy, corrected MPLS mark offset and
added UDF allocation bounds, hardened the mux/codec framing and M2TS paths,
guarded SCSI READ CAPACITY short transfers and unified error mapping, added
overflow guards on untrusted disc input, and made prefetch shutdown
deterministic. Release profile now builds with thin LTO + single codegen unit.

src/mux/null.rs

@@ -18,7 +18,10 @@ impl NullStream {
 
 impl crate::pes::Stream for NullStream {
     fn read(&mut self) -> io::Result<Option<crate::pes::PesFrame>> {
-        Ok(None)
+        // Write-only sink: per the Stream trait contract, read() on a
+        // write-opened stream returns StreamWriteOnly. Returning Ok(None)
+        // would be misread as a legitimate empty stream.
+        Err(crate::error::Error::StreamWriteOnly.into())
     }
     fn write(&mut self, _: &crate::pes::PesFrame) -> io::Result<()> {
         Ok(())
@@ -53,4 +56,14 @@ mod tests {
         let _ = sink.info();
         sink.finish().unwrap();
     }
+
+    /// read() on the write-only NullStream must return StreamWriteOnly,
+    /// not Ok(None) (which a caller would misread as an empty stream).
+    #[test]
+    fn read_returns_write_only_error() {
+        let title = DiscTitle::empty();
+        let mut sink = NullStream::new(&title);
+        let err = Stream::read(&mut sink).expect_err("read on a sink must error");
+        assert_eq!(err.kind(), io::ErrorKind::Unsupported);
+    }
 }