Round 6: a large backstep only crosses when it would be misplaced

The round-5 fix advanced the clip cursor on ANY backward step over 3s. That
also fires for a corrupt PTS, and for a legitimate STC discontinuity inside one
clip — and nothing moves the cursor back, because a forward step matches
neither past_out nor stepped_back. Every later frame then sits below the new
clip IN and is dropped: on the fixture table that is ~17 minutes of one track
gone, and the only volume gate compares total drops against ALL tracks frames,
so it exits 0.

The branch now also requires the frame to be INSIDE the current clip marks,
which is the only case that would otherwise be silently placed at the old
offset — the rewind. A frame outside them needs no help: the containment check
drops and counts it, the cursor stays put, and the next good frame is placed
normally. Both behaviours have a test, each confirmed to fail without the guard.

Separately, the dir:// PES input path scanned the folder and never applied the
encryption verdict scan_dir exists to produce, so the same folder ripped
through one door and failed through the other asking for a key it does not
need. That logic now lives in one function, session::apply_folder_encryption_verdict,
called by both.

src/session.rs

@@ -475,16 +475,35 @@ pub fn scan_dir(path: &Path, opts: ScanOptions) -> Result<(Disc, Box<dyn SectorS
     let capacity = reader.capacity_sectors();
     let mut disc = Disc::scan_image(&mut reader, capacity, &opts)?;
 
+    apply_folder_encryption_verdict(&mut reader, &mut disc)?;
+    Ok((disc, Box::new(reader)))
+}
+
+/// Re-judge a FOLDER's encryption verdict from its CONTENT.
+///
+/// `Disc::scan_with` decides `encrypted` from tree shape — whether an `AACS/`
+/// directory is present. That is right for an image and wrong for a verbatim
+/// copy of an already-decrypted disc that kept the directory: the rip would
+/// fail asking for a key it does not need.
+///
+/// Shared by [`scan_dir`] and by the `dir://` PES input path in
+/// `mux::resolve`. It lives in one place because the two disagreed: a folder
+/// that ripped through `scan_dir` failed through `input()`, which is the exact
+/// failure this probe was written to prevent, reachable by the other door.
+pub(crate) fn apply_folder_encryption_verdict(
+    reader: &mut dyn SectorSource,
+    disc: &mut Disc,
+) -> Result<()> {
     // `css.is_some()` is the DVD path, and that verdict came from actually
     // cracking scrambled sectors — real evidence about content, not tree shape.
     // Only the AACS-by-tree-shape verdict is re-judged here.
     if disc.encrypted && disc.css.is_none() && disc.css_error.is_none() {
-        match probe_folder_encryption(&mut reader, &disc)? {
+        match probe_folder_encryption(reader, disc)? {
             true => return Err(Error::DirImageEncrypted),
             false => {
                 tracing::warn!(
                     target: "freemkv::scan",
-                    phase = "scan_dir",
+                    phase = "folder_verdict",
                     "folder carries an AACS directory but its sampled content units \
                      are already in the clear; treating it as decrypted"
                 );
@@ -494,7 +513,7 @@ pub fn scan_dir(path: &Path, opts: ScanOptions) -> Result<(Disc, Box<dyn SectorS
             }
         }
     }
-    Ok((disc, Box::new(reader)))
+    Ok(())
 }
 
 /// `true` when any sampled content unit still needs decryption.