aacs(2.1): variant Media Key as a clean PK -> Km primitive

Redesign derive_media_key_variant to the minimal derivation surface:

  derive_media_key_variant(mkb_records, pk) -> Km

- PK-input only. Deriving Kp from device keys (DK -> PK) is a separate
  concern (walk_processing_key); a leaked 2.1 key is a PK, and the chain
  starts at Kp. A bare PK arrives without its subset-difference slot, so
  the primitive tries it against every slot and returns the Km for the
  slot that passes the MKB's Verify-Media-Key record -- mirroring the
  classical bare-PK derive_media_key_from_pk, gated by the chain's own
  verify so an unverified key is never returned.
- VID-free: the Media Key is MKB-scoped. VUK stays the separate
  derive_vuk(Km, VID) step.
- KCD is a fixed algorithm constant compiled in, not a caller parameter
  (removes the kcd argument, the placeholder const, and KcdNotProvided).
- Soft-correction / online-challenge slots are treated as non-covering;
  surfaced over the generic miss so a disc needing those modes is
  distinguishable from a non-covering key.

resolve_keys_v21 updated to walk DK -> PK first, then call the primitive
and derive the VUK from Km + VID. Module + helper docs refreshed to the
pinned record layout; tests reworked for the PK-only signature.

src/aacs/mod.rs

@@ -64,7 +64,7 @@ mod tests {
     use super::content::{ALIGNED_UNIT_LEN, ts_sync_destroyed};
     use super::inf::{disc_hash, disc_hash_hex};
     use super::mkb::{AacsVersion, mkb_content_len, walk_mkb};
-    use super::variant::{KEY_CORRECTION_DATA_PLACEHOLDER, is_variant_mkb};
+    use super::variant::is_variant_mkb;
 
     #[test]
     fn aligned_unit_len_is_three_2048_byte_sectors() {
@@ -85,13 +85,6 @@ mod tests {
         assert_ne!(AacsVersion::V20, AacsVersion::V21);
     }
 
-    #[test]
-    fn key_correction_data_placeholder_is_all_zero() {
-        // The variant chain refuses to run against this all-zero placeholder
-        // KCD; the public constant must therefore be exactly 16 zero bytes.
-        assert_eq!(KEY_CORRECTION_DATA_PLACEHOLDER, [0u8; 16]);
-    }
-
     #[test]
     fn public_helpers_are_callable_by_module_path() {
         // Touch a representative function from each module so a dropped/renamed