disc: redact Debug for AacsState/Key/HandshakeResult (test-guarded)

AacsState (public via Disc.aacs) and Key (the decrypt_with key-transport enum)
are crate-root re-exported and carried VUK/unit/read-data keys + volume id on
#[derive(Debug)]; HandshakeResult carried the VID + AACS 2.0 bus key. Manual
Debug impls print shape only, guarded by red->green tests.

src/aacs/derive.rs

@@ -595,7 +595,10 @@ mod resolve_candidate_tests {
             dk: None,
         };
         let dbg = format!("{c:?}");
-        assert!(!dbg.contains("213"), "ResolvedChain leaked unit keys: {dbg}");
+        assert!(
+            !dbg.contains("213"),
+            "ResolvedChain leaked unit keys: {dbg}"
+        );
         assert!(
             dbg.contains("unit_keys_len"),
             "ResolvedChain missing redaction: {dbg}"

src/aacs/resolve.rs

@@ -498,7 +498,10 @@ mod tests {
         };
         let dbg = format!("{rk:?}");
         assert!(!dbg.contains("213"), "ResolvedKeys leaked keys: {dbg}");
-        assert!(dbg.contains("redacted"), "ResolvedKeys missing marker: {dbg}");
+        assert!(
+            dbg.contains("redacted"),
+            "ResolvedKeys missing marker: {dbg}"
+        );
     }
 
     /// Audit #5: the `major` / `from_major` mapping is load-bearing for the

src/aacs/variant.rs

@@ -660,8 +660,14 @@ mod tests {
             cvalue_index: 2,
         };
         let dbg = format!("{m:?}");
-        assert!(!dbg.contains("213"), "ProcessingKeyMatch leaked kp/cvalue: {dbg}");
-        assert!(dbg.contains("redacted"), "ProcessingKeyMatch missing marker: {dbg}");
+        assert!(
+            !dbg.contains("213"),
+            "ProcessingKeyMatch leaked kp/cvalue: {dbg}"
+        );
+        assert!(
+            dbg.contains("redacted"),
+            "ProcessingKeyMatch missing marker: {dbg}"
+        );
     }
 
     #[test]