Harden mux + decrypt paths; fail-loud on unresolvable keys

mp4 demuxer (untrusted input): bound every allocation sized from a box
field (stsz/stco/stsc counts, stts/ctts run-lengths, per-sample and moov
sizes, plus an absolute cap so a sparse file can't inflate file_len);
guard the parse_stsd slice and a zero mdhd timescale; cap track count so
the per-track PID can't overflow; rewrite read_moov to handle size==0 /
size<8 / 64-bit largesize; parse esds/AudioSpecificConfig for AAC; write
tkhd duration in the movie timescale.

decrypt: resolve_mux_key_map now fails loud on an extent no key can
classify instead of inheriting the previous extent's key, so a keymap
never silently carries a wrong key; the sweep/patch key-fetch recovery
fails loud when a unit is still unresolved after the retry.

AACS: reject inverted forensic segments in both range builders; compare
the forensic index in u16 space so an out-of-range value can't truncate
onto a valid u8 index. RECOVERED_ERROR no longer latches the damage zone,
preserving the 30s wedge cooldown for a following hard error.

audio: AAC/MP2/MP3/FLAC carry the last PTS across a PES with no timestamp;
the DTS-HD extension-sync search is bounded to after the core; the MP4
16.16 sample-rate field saturates. demux_sink records the video reference
before the kind filter so audio:// / sub:// keep multi-clip PTS continuity
and the DELAY tag.

Remove a dead error variant and the AACS-unsupported-video code; codec
comments cite the primary format specs; assorted doc/naming fixes and
regression tests throughout.

src/mux/m2ts_mux/mod.rs

@@ -1,9 +1,10 @@
 //! Standard MPEG-TS (188-byte packets) muxer — sequential-only.
 //!
 //! Distinct from `super::tsmux::TsMuxer` (BD-TS with 192-byte packets
-//! and the 4-byte TP_extra_header). This muxer emits the IETF / ISO/IEC
-//! 13818-1 wire format that ffmpeg, VLC, and `m2tsindex` consume
-//! out of the box. Use it for plain `.ts` / `.m2ts` files over a
+//! and the 4-byte TP_extra_header). This muxer emits the ITU-T H.222.0 /
+//! ISO/IEC 13818-1 wire format that any conformant transport-stream
+//! demuxer or player consumes out of the box. Use it for plain
+//! `.ts` / `.m2ts` files over a
 //! [`SequentialSink`](crate::io::sink::SequentialSink), and for
 //! MPEG-TS-over-UDP via [`UdpSocketSink`](crate::io::sink::UdpSocketSink).
 //!
@@ -44,8 +45,8 @@
 //!     attached to the video PID's adaptation field every
 //!     `PCR_INTERVAL_PACKETS` packets.
 //!   - No language / descriptor tags, no SCTE-35 markers, no per-PID
-//!     PMT version bumps, no SDT/EIT. Sufficient for "ffmpeg can play
-//!     this back", not for full broadcast deployment.
+//!     PMT version bumps, no SDT/EIT. Sufficient for a conformant
+//!     demuxer to play this back, not for full broadcast deployment.
 
 use std::io::{self, Write};