Distinguish a failed key source from one with no entry

resolve_and_apply_traced collapsed `Ok(_) | Err(_)` into a single
KeyNode::NoEntry step, so a key source that FAILED — server unreachable, keydb
unreadable, malformed entry — was recorded identically to one that simply had no
entry for this disc. The front-end renders that trace, so it told the operator
their disc is not in the database when the real cause was a fixable
infrastructure problem. drive_unit_keys and drive_fmts_indexes were refactored
this cycle to preserve exactly this distinction; this path had not been.

KeyNode gains a SourceFailed variant and the two arms are split. freemkv's
trace renderer matches KeyNode exhaustively with no catch-all, so its arm is
added in the same change — otherwise the consumer would not build.

Also made ETSI TS 102 114 the primary authority for DTS_AMODE_COUNT's comment
rather than a reference decoder internal symbol, and pointed it at this
crate's own cross-checked DTS_AMODE_LAYOUT / DTS_AMODE_CH tables.

A round-2 finding asked for every a reference decoder and a reference decoder citation in the DTS parser
to be stripped as a public-repo hygiene violation. Rejected: the project's rules
(scan-secrets.sh, CLAUDE.md) prohibit internal infrastructure references and
reverse-engineering material, and a reference-decoder citation is neither. The
AMODE channel-count table is a factual table from the standard, not expression
copied from an implementation. Citing the spec plus a corroborating
implementation is how a decodability gate should be justified.

src/keysource.rs

@@ -350,15 +350,25 @@ pub fn resolve_and_apply_traced(
                     outcome: KeyOutcome::NoKey,
                 });
             }
-            // Empty (no key here) or a source failure — both are "no key from
-            // this source"; move on to the next.
-            Ok(_) | Err(_) => {
+            // No key from this source either way, but WHY differs and the caller
+            // renders it: a source that errored is a fixable condition (server
+            // unreachable, keydb unreadable), while "no entry for this disc" is
+            // not. Recording both as NoEntry lost that distinction — the same one
+            // drive_unit_keys / drive_fmts_indexes were refactored to preserve.
+            Ok(_) => {
                 trace.keys.push(KeyStep {
                     who,
                     path: vec![KeyNode::NoEntry],
                     outcome: KeyOutcome::NoKey,
                 });
             }
+            Err(_) => {
+                trace.keys.push(KeyStep {
+                    who,
+                    path: vec![KeyNode::SourceFailed],
+                    outcome: KeyOutcome::NoKey,
+                });
+            }
         }
     }
     (false, trace)