rc2: macOS cross-compile fix + security/recovery hardening

- build.rs: pass target -arch to cc so macos_shim cross-compiles (x86_64-apple-darwin)
- AACS/CSS: unit-aligned decrypting sweep; per-VTS CSS title keys (hard-fail on wrong VTS);
  reject truncated Unit_Key_RO; AACS 2.0 sig-verify skip; CSS bus-auth random nonce
- recovery: gap-filling mapfile load; sweep/copy resume reconciliation; stale-mapfile abort;
  patch wedge/damage-window range reset
- mux: TS continuity + PSI CC desync guards; HEVC numTemporalLayers clamp; MPEG-2 pending
  byte-cap; PS parse_pts marker-bit validation; HdrFormat strict parse; Unknown-variant metadata
- net/keydb: network:// SSRF parity (IPv4-mapped, CGNAT, 0.0.0.0/8, Class-E); bounded keydb
  header read + size cap + error context
- io: durable mapfile fsync; NFS writeback degrade; sync_file_range error capture;
  Windows SCSI u32 transfer guard

src/labels/mod.rs

@@ -288,8 +288,15 @@ pub fn fill_defaults(titles: &mut [crate::disc::DiscTitle]) {
                     a.label = generate_audio_label(&a.codec, &a.channels, a.secondary);
                 }
                 Stream::Video(v) if v.label.is_empty() => {
-                    v.label =
-                        generate_video_label(&v.codec, v.resolution.pixels(), &v.hdr, v.secondary);
+                    // Unknown resolution: pass (0, 0) so the label omits the
+                    // resolution token rather than tagging it a fabricated
+                    // 1080p.
+                    let px = if matches!(v.resolution, crate::disc::Resolution::Unknown) {
+                        (0, 0)
+                    } else {
+                        v.resolution.pixels()
+                    };
+                    v.label = generate_video_label(&v.codec, px, &v.hdr, v.secondary);
                 }
                 Stream::Subtitle(s) if s.forced => {
                     // Ensure forced subs are labeled even if BD-J didn't set a name