0.18 round 2: refactor Disc::patch onto Pipeline + PatchSink

Patch was strictly serial (per-sector recovery: read → seek+write
→ mapfile.record → next). Lifting the write+record onto a consumer
thread lets the drive issue the next per-sector retry while the
previous block's recovered bytes are being committed — small but
real win on damaged discs with many bad sectors, and uniform with
sweep's threading model.

- New PatchSink: Sink<PatchItem> impl in src/disc/patch.rs. Owns
  WritebackFile + Mapfile. apply() seeks+writes recovered bytes
  and records mapfile state per item; close() runs sync_all and
  mapfile.flush.
- Channel depth: WRITE_THROUGH_DEPTH (1). Patch wants minimum
  buffering — back-pressure should kick in immediately so the
  drive's per-sector retry budget isn't ahead of the writer.
- Disc::patch: keeps every existing recovery decision on the
  producer (reverse walk, damage-window skip, NOT_READY pauses,
  bridge-degradation handling, wedge exit, range watchdog).
  WritebackFile ownership moves to the sink.

Behaviour-preserving: per-sector single-shot read budget unchanged
(BU40N+Initio bridge wedge concern still respected); recovery
algorithm bit-identical.

See freemkv-private/memory/0_18_redesign.md.

Single contributor: MattJackson.

src/io/pipeline.rs

@@ -28,13 +28,11 @@
 //!
 //! ## Dead-code suppression
 //!
-//! The `Pipeline` / `Sink` / `Flow` / `DEFAULT_PIPELINE_DEPTH` /
-//! `WRITE_THROUGH_DEPTH` items are crate-internal API today (the
-//! parent `io` module is `pub(crate)`) but have no in-tree callers
-//! in this slice — sweep is still on `disc/sweep_pipeline.rs`, patch
-//! and mux still have no pipeline at all. Wiring them up is the
-//! next slice of the 0.18 redesign. The `#[allow]` below is removed
-//! once any of those three call sites lands on this primitive.
+//! `Disc::patch` is the first in-tree caller (0.18 round 2). Sweep
+//! and mux still have their own bespoke loops; once they land on
+//! `Pipeline` too, the `#[allow]` below can drop. Until then it
+//! covers the constants and trait machinery the patch caller doesn't
+//! exercise (e.g. `DEFAULT_PIPELINE_DEPTH`).
 
 #![allow(dead_code)]