Fix audit findings: DTS AMODE bound, key-fetch negative memoization, PGS probe coverage

- dts: accept all 16 legal AMODE channel-arrangement codes (0-15), not just
  0-9. Per ETSI TS 102 114 the 6-bit AMODE field has 16 defined arrangements;
  only 16-63 are reserved. ffmpeg's ff_dca_channels[16] confirms 10-15 are
  decodable 6/7/8-channel layouts. The old bound of 10 dropped spec-legal
  multichannel core frames as undecodable, silencing recoverable audio. Add a
  regression test (literal 0..16 range) that fails if the bound reverts to 10.

- keysource: only memoize a NEGATIVE (empty) key-fetch result when every source
  genuinely ran and none held the key — never when a source Err'd (network down,
  unreachable). A transient outage was being cached as a permanent "no key" for
  the fingerprint, permanently dropping a unit that could be recovered once the
  source came back. Thread an `errored` flag out of the drivers and gate the
  cache insert on it. Tests cover both the recover-after-outage case and that a
  genuine absence is still memoized.

- pgs_forced_probe: add happy-path coverage feeding real synthetic BD-TS PGS
  display sets through the full demux -> parse -> observe -> apply path, both a
  forced verdict landing and a non-forced verdict clearing a vendor flag.

- mp4: correct fit_report doc (audio carried is AC-3/E-AC-3 AND DTS/DTS-HD).

- scan_iso test: add independent fixture expectations (volume id) so the parity
  test is no longer purely tautological against a re-run of the same composition.

tests/scan_iso.rs

@@ -141,10 +141,20 @@ fn scan_iso_matches_manual_scan_image_path() {
         .expect("manual scan_image succeeds");
 
     assert_eq!(disc.capacity_sectors, manual.capacity_sectors, "capacity");
-    assert_eq!(disc.capacity_sectors, expected_capacity, "capacity value");
     assert_eq!(disc.titles.len(), manual.titles.len(), "title count");
     assert_eq!(disc.encrypted, manual.encrypted, "encrypted flag");
     assert_eq!(disc.format, manual.format, "disc format");
+
+    // Independent expectations (not parity against a re-run of the same
+    // composition): the scanned Disc must match KNOWN properties of the fixture
+    // itself — its capacity (max LBA + 1), its PVD volume id ("TEST_DISC"), and
+    // that a UDF with no /AACS directory is unencrypted. These would fail even if
+    // scan_iso and the manual path drifted together.
+    assert_eq!(disc.capacity_sectors, expected_capacity, "capacity value");
+    assert_eq!(
+        disc.volume_id, "TEST_DISC",
+        "PVD volume id from the fixture"
+    );
     assert!(!disc.encrypted, "minimal UDF (no /AACS) is not encrypted");
 
     // The returned reader is usable: correct capacity and a real read of sector