CSS DVD: resolve the per-title key at read time, drop the scan-time crack

Every DVD read path — the file-backed mux highway (build_iso_pipeline) and
the live-drive single-pass DiscStream — now resolves the per-VTS CSS title
key through one shared step, css::resolve_dvd_title_key, cracked keylessly in
playback order from the title's own extents. Removes the earlier design that
reused a single scan-time key (meaningless for a per-VTS scheme) and muxed a
detection-miss disc's scrambled sectors as garbage.

- Disc::scan no longer cracks a key up front; it does only the CSS bus-auth
  read-unlock, hoisted before the UDF prefetch so scrambled small/menu VOBs
  no longer cost a rejected read each (CSS-DVD scan ~25s -> ~6s).
- An uncrackable title hard-fails (E7023) instead of passing ciphertext as
  plaintext; --raw skips the crack entirely; a Stop mid-crack surfaces Halted.
- DiscStream::new is now fallible and threads raw + halt.
- Fix a stale codec-parser doc claim (TrueHD/FLAC/MP2/AAC do gate via DropTally).

src/mux/codec/mod.rs

@@ -178,10 +178,9 @@ impl CodecParser for PassthroughParser {
 ///   until the next keyframe. Video instead resyncs at GOP/IDR boundaries (the
 ///   ResyncGate) and lets the decoder conceal — a fundamentally different model
 ///   than per-frame audio dropping.
-/// - TrueHD/MLP and the rare passthrough audio codecs (FLAC/MP2/AAC) do not yet
-///   gate: MLP carries inter-AU restart state so a safe drop must land on a
-///   major-sync boundary, and the passthrough codecs are essentially never seen
-///   on optical media.
+/// - TrueHD/MLP, FLAC, MP2/MP3 and AAC-ADTS also gate undecodable frames via a
+///   `DropTally` (poison/drop-forward for MLP's inter-AU restart state on a
+///   major-sync boundary; CRC/sync-verdict drops for the passthrough codecs).
 ///
 /// Create the appropriate parser for a codec, with optional codec private data.
 ///