test: salvage the orphaned labels/disc triage, and extract build_labels

Thirteen agents triaging src/labels and src/disc died on a saturated
machine, leaving 5,836 insertions across 28 files uncommitted in a
worktree. Recovered by 3-way apply onto twelve commits of drift; zero
conflicts. The diff was archived to freemkv-private first, because a
worktree is not a backup and this one had already nearly been lost.

One production change, and it is the right one: mpls_universal::parse
read every playlist off the disc AND converted the entries to labels in
a single function, so the conversion — stream-type mapping, dedup key,
the dense global counters — could only be reached through a synthetic
UDF image. Extracted to build_labels(&[Playlist]), which unit tests can
drive from already-parsed values. Behaviour-preserving: same iteration
order, same skip-on-error.

Two collisions resolved by hand:

A second mod pass_progress_tests, written independently against the
same survivors as the one committed in c610285. Kept mine — it covers
the distinct-counters case and the Progress blanket impl, which theirs
does not — but theirs had three clamp tests mine lacked: good_pct,
bad_pct and pending_pct also clamp an overshoot, and I had only tested
that for work_pct. Merged those in as one test and proved each of the
three clamps load-bearing by removing them individually.

An unused_parens warning in a new fixture.

Method note, recorded because it cost real time: git apply --3way
STAGES its result, so `git diff` reads empty and the tree looks
untouched. I nearly concluded the patch had silently failed. Worse, the
first attempt piped through `head -20`, so `echo exit=$?` reported
head's status rather than git's — the same mistake this audit has
already documented once. Check the real exit status, and check
--cached, not just the working tree.

src/scsi/mod.rs

@@ -1205,6 +1205,57 @@ mod scsi_sense_predicate_tests {
         assert_eq!(ScsiSense::NONE.sense_key, SENSE_KEY_NO_SENSE);
         assert!(ScsiSense::NONE.is_marginal());
     }
+
+    /// `is_css_locked` must be the exact triple `05/6F/03` (MMC "READ OF
+    /// SCRAMBLED SECTOR WITHOUT AUTHENTICATION"), all three fields ANDed
+    /// together — not any single field, and not an OR of the three. The
+    /// CSS crack scan keys on this to positively distinguish "encrypted but
+    /// locked" from "unreadable"; a false positive on a bare ILLEGAL REQUEST
+    /// (e.g. a malformed CDB) would make the scanner treat an unrelated
+    /// error as proof of CSS scrambling.
+    #[test]
+    fn is_css_locked_requires_exact_key_asc_ascq_triple() {
+        // The real signature: true.
+        assert!(
+            ScsiSense {
+                sense_key: SENSE_KEY_ILLEGAL_REQUEST,
+                asc: 0x6F,
+                ascq: 0x03,
+            }
+            .is_css_locked()
+        );
+        // Right key, wrong ASC only -> must be false (rules out `||`
+        // between key and asc, and rules out the `true` constant mutant).
+        assert!(
+            !ScsiSense {
+                sense_key: SENSE_KEY_ILLEGAL_REQUEST,
+                asc: 0x00,
+                ascq: 0x03,
+            }
+            .is_css_locked()
+        );
+        // Right key, right ASC, wrong ASCQ -> must be false (rules out `||`
+        // between asc and ascq).
+        assert!(
+            !ScsiSense {
+                sense_key: SENSE_KEY_ILLEGAL_REQUEST,
+                asc: 0x6F,
+                ascq: 0x00,
+            }
+            .is_css_locked()
+        );
+        // Right ASC/ASCQ but wrong key (e.g. a bare ILLEGAL REQUEST with
+        // unrelated ASC/ASCQ would already fail above; here flip the key
+        // instead) -> must be false.
+        assert!(
+            !ScsiSense {
+                sense_key: SENSE_KEY_MEDIUM_ERROR,
+                asc: 0x6F,
+                ascq: 0x03,
+            }
+            .is_css_locked()
+        );
+    }
 }
 
 #[cfg(test)]