AacsKeyMap: a positive map — no key for a sector means pass through

The key map is now purely "these sectors use this key": entry_for returns
Option and an LBA in no range is left untouched (no default-decrypt-
everything fallback). resolve_mux_key_map builds explicit content ranges
for every case — single-CPS keys each content extent, multi-CPS keys each
extent with the key that opens it, and FMTS fills the non-segment content
with the base Unit Key so a whole-disc read decrypts content and passes
nav/filesystem through. Combined with the fail-loud resolve, a map can
never silently apply a wrong key, and clear sectors are never scrambled.

decrypt_sectors_mapped skips a unit with no map entry; read_plan keeps an
unmapped unit (pass-through content) and drops only alternate-phase
forensic units. Tests updated to the Option semantics.

src/mux/disc.rs

@@ -1180,7 +1180,7 @@ mod tests {
         };
         // 100 units (300 sectors). A 10-unit Even forensic segment at LBA [30,60):
         // even units (30,36,42,48,54) are ours; odd (33,39,45,51,57) are dropped.
-        let map = AacsKeyMap::from_ranges_phased(vec![(30, 60, 1, Phase::Even)], 0);
+        let map = AacsKeyMap::from_ranges_phased(vec![(30, 60, 1, Phase::Even)]);
         let stream = DiscStream::new(
             Box::new(ZeroReader { capacity: 300 }),
             synthetic_title(300),