audit: lock DTS rate table, fix sniff overflow-scan, cover decrypt loss

Round-10 findings from the 10-phase release audit:

- A finder claimed the DTS SFREQ→rate table was wrong at 11/12; verified
  it against ffmpeg's avpriv_dca_sample_rates (12k/24k/48k/96k/192k at
  11-15) — the table is CORRECT. Added a test that locks the full table so
  it can't be mis-"fixed".
- sniff_video_codec advanced 3 bytes after a matched start code, re-reading
  the code byte as an overlapping start code; skip the full 4-byte marker.
- Guard the HD-DVD next_id title counter with saturating_add so a crafted
  disc with >65536 clips can't overflow (panic in debug).
- Add a test that an undecryptable unit (DecryptFailed) is zero-filled and
  counted as loss through ExtractResult (complete=false, bytes_lost>0) —
  the recovery-seam consolidation folded that bucket into bytes_unreadable.

src/mux/codec/dts.rs

@@ -918,6 +918,37 @@ mod tests {
         assert_eq!(dts_core_sample_rate(&core), 48_000);
     }
 
+    #[test]
+    fn dts_core_sfreq_table_matches_the_dca_spec() {
+        // Lock the SFREQ → sample-rate table to ffmpeg's authoritative
+        // `avpriv_dca_sample_rates` (ETSI TS 102 114 Table 6-4). The high-rate
+        // triad in particular — 48 k / 96 k / 192 k at indices 13/14/15 — must not
+        // be shifted; a wrong entry would compute an N× frame duration and
+        // reintroduce PTS drift on a 96/192 kHz DTS stream.
+        let mut core = make_dts_core(512);
+        let set_sfreq = |c: &mut [u8], idx: u8| c[8] = (c[8] & !0x3C) | ((idx & 0x0F) << 2);
+        for (idx, want) in [
+            (1u8, 8_000u32),
+            (2, 16_000),
+            (3, 32_000),
+            (6, 11_025),
+            (7, 22_050),
+            (8, 44_100),
+            (11, 12_000),
+            (12, 24_000),
+            (13, 48_000),
+            (14, 96_000),
+            (15, 192_000),
+        ] {
+            set_sfreq(&mut core, idx);
+            assert_eq!(
+                dts_core_sample_rate(&core),
+                want,
+                "SFREQ {idx} must be {want} Hz"
+            );
+        }
+    }
+
     #[test]
     fn new_pes_rebases_to_its_own_pts_no_drift() {
         // Regression for the drift bug: a global running clock overshot a