Bind borrowed stream labels by the stream they name, not by a slot

A vendor label's `stream_number` is a slot in the one stream table its
config blob describes. The labels merged in from the playlists — to
cover streams the vendor named nothing for — carried a different number
entirely: a dense counter over every distinct stream found while
scanning the whole disc in directory order, related to no playlist's
slot numbering at all. Two coordinate systems, one field name. The
merge matched them by equality and the binder then counted streams
against the result.

Measured over the 44-image corpus: 22 discs merge such labels; of the
566 places one lands on a stream, 443 (78%) are a stream it does not
describe — the label states the PID it read itself from and it is a
different one. 142 of those are stopped by the language check 94377c7
added; 301 are applied. Those labels carry no editorial payload, so the
direct damage is confined to codec text — but the polluted list is also
what the anchor gate reads, and on 11 disc/stream-type pairs it is what
decides the anchor, which is how it reaches the vendor's forced and SDH
flags. 53 anchor facts are harvested off a merged slot. The clip-info
orphans had the same shape, numbered from `max + 1` of a list they share
no coordinate system with.

A label now either NAMES its stream — `StreamId { clip, pid }`, read out
of the very table `disc::bluray` builds the stream from — or it does
not, and only the ones that do not are ever reached by counting:

  * `label_at` returns vendor labels only, so the two numberings can no
    longer be confused by construction.
  * Playlist and clip-info labels bind by id. Exact, no anchor, no
    sequence, no ordinal.
  * A named stream outranks a guessed one, so an editorial flag reaches
    a stream only where the disc's own numbering puts it there.
  * The presence of an id is the provenance the anchor gate was missing.
    It reads the vendor's slots alone now, so a slot the vendor never
    named no longer breaks the sequence — under-yield is the normal
    shape of these blobs — and a title with fewer streams than the list
    has slots is no longer eligible to hold it. Ranking prefers the
    title that positively confirms most of the list.
  * An orphan is in no playlist, hence in no title, so it binds to
    nothing rather than to whatever counted its way.

The MPLS floor is one label per physical stream keyed by `(clip, PID)`,
not by `(type, language, codec, pid)`: the same PID in two clips is two
streams, and the old key collapsed them. Its `stream_number` is now the
entry's real slot in its own playlist's table.

41 of 44 images are byte-identical; all three that move lose a label
they should not have had, and no feature title changes on any image. A
dozen featurette playlists stop reporting a feature subtitle's SDH
marking on their own unrelated subtitle; eleven menu and bonus titles
stop advertising the feature's object-audio format on plain stereo; and
on a disc whose every title carries a single audio stream — too short a
table to anchor anything — a regional-variant tag asserted on all
seventeen titles is now asserted on none, in exchange for every title
stating the codec it actually carries, which none of them did.

Six tests had been asserting the invented numbering, including one
pinning the disc-global counter as a deliberate property.

Also fixes a defect in the same family that the corpus work surfaced:
`pgs_forced_probe::apply_verdicts` set `forced` but left `qualifier`,
so a demoted track shipped with a metadata sidecar calling it forced
next to a Matroska header saying it is not. Only a forced claim is
cleared; an SDH marking is not the probe's to touch.

src/disc/pgs_forced_probe.rs

@@ -854,6 +854,21 @@ fn apply_verdicts(title: &mut DiscTitle, verdicts: &HashMap<u16, bool>) {
             && let Some(&forced) = verdicts.get(&sub.pid)
         {
             sub.forced = forced;
+            // A demoted track must not go on describing itself as forced. The
+            // flag and the qualifier are two renderings of one fact for
+            // different consumers — the muxer writes `FlagForced` from
+            // `forced`, the JSON sidecar writes its qualifier string from
+            // `qualifier` — so leaving `Forced` behind here published a track
+            // whose sidecar said "forced" and whose Matroska header said it was
+            // not. The probe read the content; it outranks the vendor's claim.
+            //
+            // Only this direction is a contradiction. `qualifier == None` on a
+            // track the probe promoted is not one: `None` is the absence of an
+            // editorial qualifier, not an assertion that the track is ordinary,
+            // and the vendor never claimed otherwise.
+            if !forced && sub.qualifier == crate::disc::LabelQualifier::Forced {
+                sub.qualifier = crate::disc::LabelQualifier::None;
+            }
         }
     }
 }
@@ -2045,6 +2060,52 @@ mod tests {
         })
     }
 
+    /// Spec: a verdict that DEMOTES a track clears a `Forced` qualifier with
+    /// it. The two fields are one fact rendered for two consumers — the muxer
+    /// writes Matroska `FlagForced` from `forced`, the JSON metadata sidecar
+    /// writes its qualifier string from `qualifier` — so leaving the qualifier
+    /// behind publishes a track that calls itself forced next to a header that
+    /// says it is not.
+    ///
+    /// Mutation: delete the qualifier assignment in `apply_verdicts` — the
+    /// track comes out `forced == false, qualifier == Forced`.
+    #[test]
+    fn a_demoted_track_stops_calling_itself_forced() {
+        let mut title = pgs_title(0x1200, true);
+        if let Stream::Subtitle(sub) = &mut title.streams[0] {
+            sub.qualifier = LabelQualifier::Forced;
+        }
+        apply_verdicts(&mut title, &HashMap::from([(0x1200u16, false)]));
+        let Stream::Subtitle(sub) = &title.streams[0] else {
+            unreachable!()
+        };
+        assert!(!sub.forced);
+        assert_eq!(
+            sub.qualifier,
+            LabelQualifier::None,
+            "the content outranks the vendor's claim, and both renderings of it move together"
+        );
+    }
+
+    /// Spec: a qualifier that is not a forced claim is not the probe's to
+    /// touch. `Sdh` says something about the track's content that a
+    /// forced-narrative verdict neither confirms nor refutes.
+    ///
+    /// Mutation: clear the qualifier unconditionally on demotion — the SDH
+    /// marking is lost.
+    #[test]
+    fn a_demoted_track_keeps_a_qualifier_that_is_not_a_forced_claim() {
+        let mut title = pgs_title(0x1200, true);
+        if let Stream::Subtitle(sub) = &mut title.streams[0] {
+            sub.qualifier = LabelQualifier::Sdh;
+        }
+        apply_verdicts(&mut title, &HashMap::from([(0x1200u16, false)]));
+        let Stream::Subtitle(sub) = &title.streams[0] else {
+            unreachable!()
+        };
+        assert_eq!(sub.qualifier, LabelQualifier::Sdh);
+    }
+
     fn forced_flag(title: &DiscTitle, pid: u16) -> bool {
         title
             .streams