libfreemkv: v1.0 hardening — codec/EBML/TS robustness + DTS parser fixes

Audit-driven fixes (rounds 1–3):
- hevc: correct hvcC profile/level SPS offsets (HEVC has a 2-byte NAL header)
- mkv: map all DTS variants to the registered A_DTS codec id; force a new
  cluster before the i16 cluster-relative timestamp can overflow
- ebml/mkvstream: bound untrusted EBML sizes (no multi-GB allocs); reject
  uint>8 (was an OOB panic) and non-{0,4,8} float widths (were a desync)
- ts: skip PES-header bytes that span a TS packet boundary; add the PMT
  section_len/prog_info_len bounds the PAT parser already had
- ac3: preserve a 0x0B77 syncword split across a PES boundary; cap buffer
- dts: validate each next-core boundary by decoded core size (a 0x7FFE8001
  pattern inside XLL payload no longer false-splits/drops the lossless
  extension); reject sub-minimum core frames; fix forced-emit PTS base
- lpcm: DVD program-stream PCM no longer double-strips the BD LPCM header
- vc1/mpeg2: do not emit a parameter-set-only PES as a standalone frame
- pgs/truehd: cap the pending reassembly buffer (parity with ac3/dts)
- aacs: ts_syncs_intact uses the exact packet count
- prefetched: capacity-guard the recycled-buffer set_len
- Cargo.toml: exclude project docs from the published crate

Convergence: a third independent audit pass found no remaining material
(CRITICAL/HIGH/MEDIUM) issues. Full precommit (fmt + clippy -D + tests,
Rust 1.86) green.

src/mux/codec/truehd.rs

@@ -16,6 +16,12 @@ use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 /// Duration of one TrueHD access unit in nanoseconds (1/1200 second).
 const AU_DURATION_NS: i64 = 833_333;
 
+/// Hard cap on the reassembly buffer. A valid TrueHD/MAT access unit is
+/// well under 32 KiB; if the buffer grows far past that without yielding a
+/// frame the stream is malformed, so we drop it and resync rather than grow
+/// without bound. Parity with the AC-3 / DTS / PGS caps.
+const MAX_TRUEHD_BUF: usize = 256 * 1024;
+
 pub struct TrueHdParser {
     buf: Vec<u8>,
     next_pts_ns: i64,
@@ -145,6 +151,12 @@ impl CodecParser for TrueHdParser {
             self.next_pts_ns += AU_DURATION_NS;
         }
 
+        // Bound memory on malformed input: a stream that never yields a
+        // complete frame must not grow the buffer without limit.
+        if self.buf.len() > MAX_TRUEHD_BUF {
+            self.buf.clear();
+        }
+
         frames
     }