rc2: macOS cross-compile fix + security/recovery hardening

- build.rs: pass target -arch to cc so macos_shim cross-compiles (x86_64-apple-darwin)
- AACS/CSS: unit-aligned decrypting sweep; per-VTS CSS title keys (hard-fail on wrong VTS);
  reject truncated Unit_Key_RO; AACS 2.0 sig-verify skip; CSS bus-auth random nonce
- recovery: gap-filling mapfile load; sweep/copy resume reconciliation; stale-mapfile abort;
  patch wedge/damage-window range reset
- mux: TS continuity + PSI CC desync guards; HEVC numTemporalLayers clamp; MPEG-2 pending
  byte-cap; PS parse_pts marker-bit validation; HdrFormat strict parse; Unknown-variant metadata
- net/keydb: network:// SSRF parity (IPv4-mapped, CGNAT, 0.0.0.0/8, Class-E); bounded keydb
  header read + size cap + error context
- io: durable mapfile fsync; NFS writeback degrade; sync_file_range error capture;
  Windows SCSI u32 transfer guard

src/mux/mkvstream.rs

@@ -214,7 +214,14 @@ impl crate::pes::Stream for MkvStream {
                         if cs == u64::MAX {
                             return Err(crate::error::Error::MkvInvalid.into());
                         }
-                        remaining = remaining.saturating_sub(hlen as u64 + cs);
+                        // A child whose header + body exceeds the bytes left in
+                        // the BlockGroup is malformed — reject it rather than
+                        // saturating `remaining` to 0 and reading past the group.
+                        let consumed = (hlen as u64).saturating_add(cs);
+                        if consumed > remaining {
+                            return Err(crate::error::Error::MkvInvalid.into());
+                        }
+                        remaining -= consumed;
                         match cid {
                             ebml::BLOCK => {
                                 block = Some(ebml::read_binary_val(