audit: byte caps on GOP buffers, opener-scan resume, honest video codec

Round-6 findings from the 10-phase release audit:

- Wire the documented MAX_PENDING_BYTES byte cap into the MPEG-2 GOP
  buffer (it was dead code) and add an equivalent MAX_GOP_BYTES cap to the
  sparse-PTS reorder, so a crafted stream of few-but-huge access units
  cannot over-allocate — both were bounded only by frame count before.
- probe_evo_streams defaulted an unsniffable HD-DVD video stream to H.264,
  which mis-parses a VC-1 (or still-encrypted) clip into a corrupt track.
  Emit the video stream only when the codec is actually identified — the
  honest outcome, matching the audio path (a real clear clip always carries
  its sequence header at the head).
- Resume the AU-opener search from a cursor (like the boundary search), so
  a long unsynced junk run is O(bytes), not O(buffer) per push.
- Mark mpeg2's now-dead MAX_AU_BUFFER test-only; restore #[doc(hidden)] on
  the aacs probe harness module.
- Add regression tests: the 0xFD video-routing guard, the FMTS-is-UHD key
  state, and the GOP byte caps.

src/disc/mod.rs

@@ -4854,6 +4854,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn inject_unit_keys_labels_fmts_as_uhd_family() {
+        // FMTS is AACS 2.1 — a UHD-family, bus-encrypted format. Injecting a UK
+        // on an FMTS disc must synthesize the UHD version + bus encryption, not
+        // mislabel it AACS 1.0 / bus-off (which would break FMTS decryption on
+        // the mapfile-recovered-UK path).
+        let mut disc = make_test_disc(1000, "FMTS");
+        disc.format = DiscFormat::Fmts;
+        disc.encrypted = true;
+        disc.inject_unit_keys(vec![(0u32, [0x22u8; 16])]);
+        let aacs = disc.aacs.as_ref().expect("aacs state synthesized");
+        assert_eq!(
+            aacs.version,
+            crate::aacs::mkb::AACS_MAJOR_UHD,
+            "FMTS is AACS 2.x (UHD major), not BD"
+        );
+        assert!(aacs.bus_encryption, "FMTS is bus-encrypted like UHD");
+    }
+
     /// Build an AacsState carrying the given unit keys (other fields are inert
     /// defaults — these tests only exercise the unit-key/decrypt-keys plumbing).
     fn aacs_with(unit_keys: Vec<(u32, [u8; 16])>) -> AacsState {