CSS DVD: resolve the per-title key at read time, drop the scan-time crack

Every DVD read path — the file-backed mux highway (build_iso_pipeline) and
the live-drive single-pass DiscStream — now resolves the per-VTS CSS title
key through one shared step, css::resolve_dvd_title_key, cracked keylessly in
playback order from the title's own extents. Removes the earlier design that
reused a single scan-time key (meaningless for a per-VTS scheme) and muxed a
detection-miss disc's scrambled sectors as garbage.

- Disc::scan no longer cracks a key up front; it does only the CSS bus-auth
  read-unlock, hoisted before the UDF prefetch so scrambled small/menu VOBs
  no longer cost a rejected read each (CSS-DVD scan ~25s -> ~6s).
- An uncrackable title hard-fails (E7023) instead of passing ciphertext as
  plaintext; --raw skips the crack entirely; a Stop mid-crack surfaces Halted.
- DiscStream::new is now fallible and threads raw + halt.
- Fix a stale codec-parser doc claim (TrueHD/FLAC/MP2/AAC do gate via DropTally).

tests/integration_progress_and_halt.rs

@@ -136,7 +136,16 @@ fn test_bytes_read_emitted_during_disc_copy() {
     let title = synthetic_title(64);
     let keys = libfreemkv::DecryptKeys::None;
 
-    let mut stream = DiscStream::new(Box::new(reader), title, keys, 60, ContentFormat::BdTs);
+    let mut stream = DiscStream::new(
+        Box::new(reader),
+        title,
+        keys,
+        60,
+        ContentFormat::BdTs,
+        false,
+        None,
+    )
+    .unwrap();
 
     let count = Arc::new(AtomicU64::new(0));
     let count_cb = count.clone();
@@ -286,7 +295,16 @@ fn test_drop_impls_do_not_panic_or_block() {
     let reader = ZeroSectorReader::new(64);
     let title = synthetic_title(64);
     let keys = libfreemkv::DecryptKeys::None;
-    let stream = DiscStream::new(Box::new(reader), title, keys, 60, ContentFormat::BdTs);
+    let stream = DiscStream::new(
+        Box::new(reader),
+        title,
+        keys,
+        60,
+        ContentFormat::BdTs,
+        false,
+        None,
+    )
+    .unwrap();
 
     // Drop on a worker thread; main thread enforces the timeout.
     let handle = std::thread::spawn(move || {