unlock: dispatch via freemkv-unlock; delete in-tree handshake/css-auth/registry

Rewire the three unlock dispatch points through the freemkv-unlock crate via a
private `unlock_bridge`: drive-prep (kind=Unknown) at `Drive::init`, AACS cert
(kind=Aacs) at `do_handshake_cert`, CSS bus-auth (kind=Css) at scan. The bridge
news up `all_unlockers()` and runs the first matching one, mapping its
`Unlocked` result to the bus-key gate. After a successful drive unlock,
libfreemkv issues a generic SET CD SPEED (max) itself — the old per-unlocker
trait method is gone.

Delete the in-tree unlock code now owned by freemkv-unlock: the AACS cert
handshake (`aacs/handshake.rs`), the CSS bus-auth (`css/auth.rs`), and the
unlock registry (`unlock.rs`). Host-cert collection (a keysource concern) stays
in a small `aacs/host_certs.rs`. No public unlock surface remains — clients
touch libfreemkv only, oblivious to unlockers (as they are to SCSI). 2277 tests
pass.

src/platform/mod.rs

@@ -1,7 +1,7 @@
 //! Platform-specific filesystem / IO helpers.
 //!
-//! Drive unlock no longer lives here — it moved out behind the pluggable
-//! [`crate::unlock::Unlocker`] seam. This module now carries only the
-//! filesystem-type detection used by the writeback / sink paths.
+//! Drive unlock no longer lives here — it moved out to the `freemkv-unlock`
+//! crate (consumed via [`crate::unlock_bridge`]). This module now carries only
+//! the filesystem-type detection used by the writeback / sink paths.
 
 pub mod fs_type;