Audit round 4-6: disc parsing, extents, codecs and drive faults

Squashed from 12 commits. Every fix was proven red-before-green and killed by a
mutation; the reasoning for each is in the private audit record.

UDF and extents
  Honour ICB types rather than assuming a Short AD, so an AD-type-3 directory
  is no longer decoded from FID bytes into a silently empty listing. Carry the
  ECMA-167 recorded flag through to the resolvers: an allocated-but-never-
  written extent used to reach the read plan as ordinary content and splice
  undefined sectors into the rip. file_extents now refuses such a file, and
  only when the hole actually occupies byte space — a zero-length one displaces
  nothing, and refusing on it dropped whole titles off discs that ripped
  correctly. Type-2 sparse extents are kept alongside type-1; they were falling
  into a catch-all that exited the descriptor loop and returned a truncated
  list as complete. merge_ranges no longer claims a sector neither input
  covered. A short skip or an over-long AD chain errors instead of truncating.

HD-DVD and Blu-ray scanning
  Bound the XPL nesting depth, title count, clips and chapters per title, and
  memoize the clip-name fallback probe — four separate amplification axes, each
  of which alone left the worst case unbounded. The clip and title caps are 512,
  ~10x any retail disc, and a test pins the product of cap and probe budget.
  The scan is cancellable: it returned Ok with titles carrying no streams when
  halted, presenting a cancelled scan as a successful one. A clip dropped for an
  unrecorded extent now says so.

Codecs and muxing
  Resume a held E-AC-3 access unit rather than rescanning from its first frame,
  and drop it on a discontinuity — a stale hold indexed past the end of the new
  buffer. Map every ISO 639-1 code instead of collapsing fifteen languages to
  und. Correct the DVD palette order. Detect a skip past EOF.

Drive and I/O
  Classify dead-bus faults so the wedged-drive path can see them; a catch-all
  arm had been flattening the variants before the classifier ran. A prefetch
  producer that dies now reports SourceTerminated instead of Ok(0), which the
  reader legitimately read as a short read and zero-filled — a whole title
  could be fabricated and the pass reported complete.

Also: charge Ok(0) reads to the CSS crack budget, drop the unreachable soft
re-crack, and send disc-derived strings to logs through the debug formatter so
a crafted label cannot paint an operator's terminal.

src/labels/deluxe.rs

@@ -85,16 +85,16 @@ pub fn parse(reader: &mut dyn SectorSource, udf: &UdfFs) -> Option<ParseResult>
         let enums = identify_master_enums(archive);
         if enums.is_empty() {
             tracing::info!(
-                jar = %entry_name,
+                jar = ?entry_name,
                 "deluxe: com/bydeluxe/ present but no master enum fingerprint matched"
             );
             return None;
         }
         for (label, m) in &enums {
             tracing::info!(
-                jar = %entry_name,
+                jar = ?entry_name,
                 enum = %label,
-                class = %m.class_name,
+                class = ?m.class_name,
                 count = m.values.len(),
                 "deluxe master enum identified",
             );
@@ -110,15 +110,15 @@ pub fn parse(reader: &mut dyn SectorSource, udf: &UdfFs) -> Option<ParseResult>
         let binding_classes = find_binding_classes(archive, &master_table.class_name_set());
         if binding_classes.is_empty() {
             tracing::info!(
-                jar = %entry_name,
+                jar = ?entry_name,
                 "deluxe: no binding class found (no class has enough getstatic refs to master enums)"
             );
             return None;
         }
         for (name, count) in &binding_classes {
             tracing::info!(
-                jar = %entry_name,
-                binding_class = %name,
+                jar = ?entry_name,
+                binding_class = ?name,
                 getstatic_count = count,
                 "deluxe binding class candidate",
             );
@@ -138,7 +138,7 @@ pub fn parse(reader: &mut dyn SectorSource, udf: &UdfFs) -> Option<ParseResult>
         }
         if streams.is_empty() {
             tracing::info!(
-                jar = %entry_name,
+                jar = ?entry_name,
                 "deluxe: binding classes found but produced 0 decoded streams"
             );
             return None;
@@ -149,7 +149,7 @@ pub fn parse(reader: &mut dyn SectorSource, udf: &UdfFs) -> Option<ParseResult>
             return None;
         }
         tracing::info!(
-            jar = %entry_name,
+            jar = ?entry_name,
             audio = labels.iter().filter(|l| l.stream_type == StreamLabelType::Audio).count(),
             subtitle = labels.iter().filter(|l| l.stream_type == StreamLabelType::Subtitle).count(),
             "deluxe emitted labels",