Harden mux + decrypt paths; fail-loud on unresolvable keys

mp4 demuxer (untrusted input): bound every allocation sized from a box
field (stsz/stco/stsc counts, stts/ctts run-lengths, per-sample and moov
sizes, plus an absolute cap so a sparse file can't inflate file_len);
guard the parse_stsd slice and a zero mdhd timescale; cap track count so
the per-track PID can't overflow; rewrite read_moov to handle size==0 /
size<8 / 64-bit largesize; parse esds/AudioSpecificConfig for AAC; write
tkhd duration in the movie timescale.

decrypt: resolve_mux_key_map now fails loud on an extent no key can
classify instead of inheriting the previous extent's key, so a keymap
never silently carries a wrong key; the sweep/patch key-fetch recovery
fails loud when a unit is still unresolved after the retry.

AACS: reject inverted forensic segments in both range builders; compare
the forensic index in u16 space so an out-of-range value can't truncate
onto a valid u8 index. RECOVERED_ERROR no longer latches the damage zone,
preserving the 30s wedge cooldown for a following hard error.

audio: AAC/MP2/MP3/FLAC carry the last PTS across a PES with no timestamp;
the DTS-HD extension-sync search is bounded to after the core; the MP4
16.16 sample-rate field saturates. demux_sink records the video reference
before the kind filter so audio:// / sub:// keep multi-clip PTS continuity
and the DELAY tag.

Remove a dead error variant and the AACS-unsupported-video code; codec
comments cite the primary format specs; assorted doc/naming fixes and
regression tests throughout.

src/mux/codec/dropgate.rs

@@ -8,8 +8,9 @@
 //! as a decoder-choking glitch.
 //!
 //! The DETECTION is inherently per-codec — each format carries its own
-//! authoritative corruption check (DTS: ffmpeg's core-header parse; AC-3: the
-//! header CRC; FLAC: the frame CRC-16; …). This type only carries the UNIFORM
+//! authoritative corruption check (DTS: the core sync/header parse per ETSI TS
+//! 102 114; AC-3: the header CRC per ETSI TS 102 366; FLAC: the frame CRC-16; …).
+//! This type only carries the UNIFORM
 //! response so every audio parser behaves identically:
 //!
 //! 1. **Count** kept vs dropped AUs and the dropped duration.
@@ -198,4 +199,17 @@ mod tests {
         }
         assert!(!t.is_poisoned());
     }
+
+    #[test]
+    fn collateral_drops_never_poison_the_track() {
+        // A TrueHD resync-forward run collaterally drops a long burst of AUs, but
+        // none are individually undecodable — the whole-track verdict must stay
+        // clean so one corruption event can't amplify into a false total loss.
+        let mut t = DropTally::new("test");
+        for _ in 0..(TRACK_VERDICT_MIN_AUS * 3) {
+            t.record_collateral_drop(0, 1000, 512, "resync-forward");
+        }
+        assert!(t.dropped_frames() >= TRACK_VERDICT_MIN_AUS, "drops counted");
+        assert!(!t.is_poisoned(), "collateral drops must not poison");
+    }
 }