disc: redact Debug for AacsState/Key/HandshakeResult (test-guarded)

AacsState (public via Disc.aacs) and Key (the decrypt_with key-transport enum)
are crate-root re-exported and carried VUK/unit/read-data keys + volume id on
#[derive(Debug)]; HandshakeResult carried the VID + AACS 2.0 bus key. Manual
Debug impls print shape only, guarded by red->green tests.

src/aacs/resolve.rs

@@ -498,7 +498,10 @@ mod tests {
         };
         let dbg = format!("{rk:?}");
         assert!(!dbg.contains("213"), "ResolvedKeys leaked keys: {dbg}");
-        assert!(dbg.contains("redacted"), "ResolvedKeys missing marker: {dbg}");
+        assert!(
+            dbg.contains("redacted"),
+            "ResolvedKeys missing marker: {dbg}"
+        );
     }
 
     /// Audit #5: the `major` / `from_major` mapping is load-bearing for the