rc2: macOS cross-compile fix + security/recovery hardening

- build.rs: pass target -arch to cc so macos_shim cross-compiles (x86_64-apple-darwin)
- AACS/CSS: unit-aligned decrypting sweep; per-VTS CSS title keys (hard-fail on wrong VTS);
  reject truncated Unit_Key_RO; AACS 2.0 sig-verify skip; CSS bus-auth random nonce
- recovery: gap-filling mapfile load; sweep/copy resume reconciliation; stale-mapfile abort;
  patch wedge/damage-window range reset
- mux: TS continuity + PSI CC desync guards; HEVC numTemporalLayers clamp; MPEG-2 pending
  byte-cap; PS parse_pts marker-bit validation; HdrFormat strict parse; Unknown-variant metadata
- net/keydb: network:// SSRF parity (IPv4-mapped, CGNAT, 0.0.0.0/8, Class-E); bounded keydb
  header read + size cap + error context
- io: durable mapfile fsync; NFS writeback degrade; sync_file_range error capture;
  Windows SCSI u32 transfer guard

src/mux/codec/hevc.rs

@@ -447,7 +447,10 @@ impl CodecParser for HevcParser {
         //   numTemporalLayers u(3) = sps_max_sub_layers_minus1 + 1
         //   temporalIdNested  u(1) = sps_temporal_id_nesting_flag
         //   lengthSizeMinusOne u(2) = 3 (4-byte length prefix)
-        let num_temporal_layers = (chroma.max_sub_layers_minus1 + 1) & 0x07;
+        // sps_max_sub_layers_minus1 is u(3) (0..7), so +1 is 1..8. The hvcC
+        // numTemporalLayers field is u(3) (0..7); the max legal value (8) is
+        // saturated to 7 rather than wrapping to 0 via the & 0x07 mask.
+        let num_temporal_layers = chroma.max_sub_layers_minus1.saturating_add(1).min(7) & 0x07;
         let temporal_id_nested = chroma.temporal_id_nesting_flag & 0x01;
         record.push((num_temporal_layers << 3) | (temporal_id_nested << 2) | 0x03);
         // numOfArrays