Fix audit findings: SCSI constants, sg_io_hdr assert, handshake cap, sector overflow check

- Replace magic SCSI opcodes with named constants (S2)
- Add compile-time sg_io_hdr size assertion — 88 bytes on 64-bit (W2)
- Cap handshake cert attempts at 16 (W8)
- Validate IsoSectorReader/FileSectorReader against u32 overflow for >8TB (S8)
- encrypt.rs: limit host cert loop iterations

src/mux/iso.rs

@@ -33,7 +33,14 @@ impl IsoSectorReader {
         let file = File::open(Path::new(path))
             .map_err(|e| io::Error::new(e.kind(), format!("iso://{path}: {e}")))?;
         let size = file.metadata()?.len();
-        let capacity = (size / SECTOR_SIZE) as u32;
+        let sectors = size / SECTOR_SIZE;
+        if sectors > u32::MAX as u64 {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("iso://{path}: image too large ({} TB, max ~8 TB)", size / (1024 * 1024 * 1024 * 1024)),
+            ));
+        }
+        let capacity = sectors as u32;
         Ok(Self { file, capacity })
     }