3D MVC mux: audit round 2 (converged)

Second audit round converged (severity collapsed 6 HIGH -> 1; the one
HIGH was a bounded 32-element scan, not a defect; the sole spec MEDIUM
was the same false-positive re-raised — 0xBF matches ISO/IEC 14496-15
§7.6.2 verbatim). One genuine robustness fix plus coverage:

- extract_mvc_params: skip a zero-length NAL instead of abandoning the
  scan, so a stray length prefix before the subset SPS/PPS no longer
  silently drops 3D signalling. Test proves params after a zero-length
  NAL are still found.
- Tests: parser_for_mvc_dependent routes H.264 to a passthrough parser;
  passthrough with an IDR does not re-assert param sets (the keyframe &&
  !mvc branch).
- Document the per-playlist (not per-clip) is_3d latching as a known
  limitation (real main-feature playlists are uniformly 3D).

src/mux/mkvstream.rs

@@ -299,7 +299,13 @@ fn extract_mvc_params(data: &[u8]) -> Option<(Vec<u8>, Vec<u8>)> {
     while i + 4 <= data.len() {
         let len = u32::from_be_bytes([data[i], data[i + 1], data[i + 2], data[i + 3]]) as usize;
         i += 4;
-        if len == 0 || i + len > data.len() {
+        // A zero-length NAL (a stray length prefix) is skipped, not fatal — the
+        // subset SPS / PPS may still follow. A length that runs past the buffer
+        // end IS unrecoverable (the NAL can't be read), so stop there.
+        if len == 0 {
+            continue;
+        }
+        if i + len > data.len() {
             break;
         }
         let nal = &data[i..i + len];
@@ -1315,12 +1321,19 @@ mod tests {
         assert!(extract_mvc_params(&[0, 0, 0]).is_none());
         assert!(
             extract_mvc_params(&[0, 0, 0, 0]).is_none(),
-            "zero-length NAL breaks"
+            "lone zero-length NAL yields no params"
         );
         assert!(
             extract_mvc_params(&[0, 0, 0, 10, 0x6F]).is_none(),
             "length prefix past end breaks, no slice panic"
         );
+        // A zero-length NAL is SKIPPED, not fatal: valid param sets that follow
+        // are still found (a stray length prefix must not abandon the whole AU).
+        let mut d = vec![0, 0, 0, 0];
+        d.extend_from_slice(&lp(&[&SUBSET_SPS, &DEP_PPS]));
+        let (s, p) = extract_mvc_params(&d).expect("params found past the zero-length NAL");
+        assert_eq!(s, SUBSET_SPS);
+        assert_eq!(p, DEP_PPS);
     }
 
     #[test]