libfreemkv: v1.0 hardening — codec/EBML/TS robustness + DTS parser fixes

Audit-driven fixes (rounds 1–3):
- hevc: correct hvcC profile/level SPS offsets (HEVC has a 2-byte NAL header)
- mkv: map all DTS variants to the registered A_DTS codec id; force a new
  cluster before the i16 cluster-relative timestamp can overflow
- ebml/mkvstream: bound untrusted EBML sizes (no multi-GB allocs); reject
  uint>8 (was an OOB panic) and non-{0,4,8} float widths (were a desync)
- ts: skip PES-header bytes that span a TS packet boundary; add the PMT
  section_len/prog_info_len bounds the PAT parser already had
- ac3: preserve a 0x0B77 syncword split across a PES boundary; cap buffer
- dts: validate each next-core boundary by decoded core size (a 0x7FFE8001
  pattern inside XLL payload no longer false-splits/drops the lossless
  extension); reject sub-minimum core frames; fix forced-emit PTS base
- lpcm: DVD program-stream PCM no longer double-strips the BD LPCM header
- vc1/mpeg2: do not emit a parameter-set-only PES as a standalone frame
- pgs/truehd: cap the pending reassembly buffer (parity with ac3/dts)
- aacs: ts_syncs_intact uses the exact packet count
- prefetched: capacity-guard the recycled-buffer set_len
- Cargo.toml: exclude project docs from the published crate

Convergence: a third independent audit pass found no remaining material
(CRITICAL/HIGH/MEDIUM) issues. Full precommit (fmt + clippy -D + tests,
Rust 1.86) green.

src/sector/prefetched.rs

@@ -157,14 +157,15 @@ impl PrefetchedSectorSource {
                         Ok(b) => b,
                         Err(_) => return, // consumer dropped both channels
                     };
-                    if buf.len() < bytes {
-                        buf.resize(bytes, 0);
-                    } else {
-                        // Re-expose the full extent; previous truncate
-                        // shrank the visible len without freeing pages.
-                        // SAFETY: capacity is at least `bytes` after
-                        // construction with `vec![0u8; batch_bytes]`.
+                    if bytes <= buf.capacity() {
+                        // Re-expose `bytes` without zero-filling pages that
+                        // `read_sectors` is about to overwrite. The capacity
+                        // guard makes the `set_len` provably sound even if a
+                        // recycled buffer ever comes back smaller than the
+                        // `vec![0u8; batch_bytes]` it was born with.
                         unsafe { buf.set_len(bytes) };
+                    } else {
+                        buf.resize(bytes, 0);
                     }
                     let lba = extent.start_lba + offset;
                     match reader.read_sectors(lba, sectors, &mut buf[..bytes], false) {