audit: drop dead DTS marks cap, lazy passthrough buf, doc corrections

Round-9 findings from the 10-phase release audit (no HIGH):

- Remove the MAX_PTS_MARKS backstop and its tautological test: an empty
  DTS PES returns before recording a mark, and a non-empty run is already
  bounded by the MAX_AU_BYTES buffer clear (which clears pts_marks) — so
  the deque cannot grow unbounded and the cap was dead code.
- AuAssembler::for_codec no longer reserves 256 KiB for a Passthrough
  stream (audio/subtitle, and every TS/BD stream) whose buf is never
  written; only the reassembling modes reserve.
- Correct the scan comment that claimed region is computed (it is a
  Region-free stub until region detection lands) and drop a public-repo
  reference to internal "private refactor notes" in the mkb module doc.

src/mux/au_assembly.rs

@@ -142,7 +142,13 @@ impl AuAssembler {
         };
         Self {
             mode,
-            buf: Vec::with_capacity(256 * 1024),
+            // Passthrough never writes `buf` (one fragment → one unit); only the
+            // reassembling modes need reserve. Avoids ~256 KiB per audio/subtitle
+            // stream (and every TS/BD stream, which never feeds the assembler).
+            buf: match mode {
+                Mode::Passthrough => Vec::new(),
+                _ => Vec::with_capacity(256 * 1024),
+            },
             base: 0,
             marks: VecDeque::new(),
             disc_marks: VecDeque::new(),

src/mux/codec/dts.rs

@@ -140,12 +140,6 @@ impl DtsParser {
 /// this without a clean boundary we resync rather than stall or balloon.
 const MAX_AU_BYTES: usize = 65536;
 
-/// Cap on buffered PTS marks. A real AU spans a few PES; this bounds the deque so
-/// a run of zero-length timed PES packets (which grow no buffer bytes, so the
-/// `drain_front` prune never fires) cannot accumulate marks without bound on
-/// hostile program-stream input.
-const MAX_PTS_MARKS: usize = 64 * 1024;
-
 /// Number of leading bytes that must be buffered before the core `fsize` field
 /// (bytes 5-7) can be decoded. This is a HEADER-LAYOUT minimum — "enough bytes
 /// to read the size field" — and is deliberately distinct from
@@ -236,15 +230,10 @@ impl CodecParser for DtsParser {
         // (see `front_pts`), so an AU whose core arrived in an earlier PES keeps
         // that core's timestamp even when its extensions / the following core
         // arrive (with a later PTS) in this same parse() call.
+        // (pts_marks is bounded implicitly: an empty PES returns above without
+        // pushing a mark, and a non-empty run grows `buf`, which is cleared —
+        // along with pts_marks — once it exceeds MAX_AU_BYTES.)
         self.pts_marks.push_back((self.buf.len(), pts_ns));
-        // Backstop: a run of zero-length (sub-header-only) PES packets that each
-        // carry a PTS grows no buffer bytes, so `drain_front` (which prunes marks)
-        // never runs. Bound the deque directly — drop the oldest, which belongs to
-        // an already-emitted or lost AU — so hostile PS input can't accumulate
-        // marks without bound.
-        if self.pts_marks.len() > MAX_PTS_MARKS {
-            self.pts_marks.pop_front();
-        }
         self.buf.extend_from_slice(&pes.data);
 
         let mut frames = Vec::new();
@@ -929,22 +918,6 @@ mod tests {
         assert_eq!(dts_core_sample_rate(&core), 48_000);
     }
 
-    #[test]
-    fn pts_marks_stay_bounded_on_zero_length_pes() {
-        // A run of zero-length (sub-header-only) DTS PES packets that each carry a
-        // PTS grows no buffer bytes, so drain_front (which prunes marks) never
-        // runs. The MAX_PTS_MARKS backstop must bound the deque regardless.
-        let mut parser = DtsParser::new();
-        for i in 0..(MAX_PTS_MARKS * 2) {
-            parser.parse(&make_pes(Vec::new(), Some(i as i64)));
-        }
-        assert!(
-            parser.pts_marks.len() <= MAX_PTS_MARKS,
-            "pts_marks bounded, got {}",
-            parser.pts_marks.len()
-        );
-    }
-
     #[test]
     fn new_pes_rebases_to_its_own_pts_no_drift() {
         // Regression for the drift bug: a global running clock overshot a