Audit round 4-6: disc parsing, extents, codecs and drive faults

Squashed from 12 commits. Every fix was proven red-before-green and killed by a
mutation; the reasoning for each is in the private audit record.

UDF and extents
  Honour ICB types rather than assuming a Short AD, so an AD-type-3 directory
  is no longer decoded from FID bytes into a silently empty listing. Carry the
  ECMA-167 recorded flag through to the resolvers: an allocated-but-never-
  written extent used to reach the read plan as ordinary content and splice
  undefined sectors into the rip. file_extents now refuses such a file, and
  only when the hole actually occupies byte space — a zero-length one displaces
  nothing, and refusing on it dropped whole titles off discs that ripped
  correctly. Type-2 sparse extents are kept alongside type-1; they were falling
  into a catch-all that exited the descriptor loop and returned a truncated
  list as complete. merge_ranges no longer claims a sector neither input
  covered. A short skip or an over-long AD chain errors instead of truncating.

HD-DVD and Blu-ray scanning
  Bound the XPL nesting depth, title count, clips and chapters per title, and
  memoize the clip-name fallback probe — four separate amplification axes, each
  of which alone left the worst case unbounded. The clip and title caps are 512,
  ~10x any retail disc, and a test pins the product of cap and probe budget.
  The scan is cancellable: it returned Ok with titles carrying no streams when
  halted, presenting a cancelled scan as a successful one. A clip dropped for an
  unrecorded extent now says so.

Codecs and muxing
  Resume a held E-AC-3 access unit rather than rescanning from its first frame,
  and drop it on a discontinuity — a stale hold indexed past the end of the new
  buffer. Map every ISO 639-1 code instead of collapsing fifteen languages to
  und. Correct the DVD palette order. Detect a skip past EOF.

Drive and I/O
  Classify dead-bus faults so the wedged-drive path can see them; a catch-all
  arm had been flattening the variants before the classifier ran. A prefetch
  producer that dies now reports SourceTerminated instead of Ok(0), which the
  reader legitimately read as a short read and zero-filled — a whole title
  could be fabricated and the pass reported complete.

Also: charge Ok(0) reads to the CSS crack budget, drop the unreachable soft
re-crack, and send disc-derived strings to logs through the debug formatter so
a crafted label cannot paint an operator's terminal.

src/mux/codec/crc.rs

@@ -29,10 +29,17 @@ pub(crate) fn crc16_ansi(data: &[u8]) -> u16 {
 }
 
 /// CRC-16 with polynomial 0x002D, init 0, MSB-first, used by the MLP / Dolby
-/// TrueHD major-sync header checksum. NOTE: MLP's checksum is the "reversed"
-/// scheme — the stored trailer word is the little-endian-read CRC, so this
-/// standard CRC must be compared against the stored bytes read big-endian.
-/// The caller handles that comparison (see `truehd::mlp_major_sync_ok`).
+/// TrueHD major-sync header checksum.
+///
+/// NOTE: MLP's checksum is the "reversed" scheme. This function emits its two
+/// bytes in the OPPOSITE order to a standard little-endian CRC readout, so the
+/// caller swaps them back and compares against the stored trailer word read
+/// LITTLE-endian — see `truehd::mlp_major_sync_crc_ok`, which is authoritative.
+///
+/// Comparing big-endian instead is precisely the bug that function was fixed
+/// for: it could never validate a real extended major sync, so whole TrueHD
+/// tracks were dropped silently. This comment used to prescribe exactly that,
+/// and to point at a `truehd::mlp_major_sync_ok` that does not exist.
 /// Verified against real MLP/TrueHD bitstreams (225/225 major-sync AUs).
 pub(crate) fn crc16_mlp(data: &[u8]) -> u16 {
     let mut crc: u16 = 0;
@@ -103,8 +110,13 @@ mod tests {
 
     #[test]
     fn crc16_mlp_residue_property_holds() {
-        // Appending the big-endian CRC zeroes the residue over message+crc — the
-        // scheme `truehd::mlp_major_sync_ok` relies on.
+        // Appending the big-endian CRC zeroes the residue over message+crc.
+        // This is a property of the CRC itself, pinned here so a change to the
+        // polynomial or the bit order is caught. It is NOT how the TrueHD
+        // caller validates a major sync: `truehd::mlp_major_sync_crc_ok` does a
+        // swap-and-XOR compare against the little-endian trailer word. (This
+        // comment used to claim the caller relied on the residue, and named a
+        // `truehd::mlp_major_sync_ok` that does not exist.)
         let msg = [0xF8u8, 0x72, 0x6F, 0xBA];
         let c = crc16_mlp(&msg);
         let mut framed = msg.to_vec();