decrypt: one content-detected decryption stage; keep going past damage

Every input decrypts through one stage that detects its content, with
strict stale-CPI handling and partial units only at EOF. Damage no
longer ends a rip where usable content remains (E7031, UDF FID,
MPLS/CLPI truncation, whole-disc E7032). M2TS output declares tracks in
an HDMV PMT and paces PCR; network:// allows LAN and loopback and
is_blocked_ip is public; parity goldens pin today's outputs.

CONTRIBUTING.md

@@ -16,6 +16,17 @@ cargo build
 cargo test
 ```
 
+### Parity goldens
+
+`parity_*` tests pin what every input-to-output path produces today (output hashes, loss
+counters, refusal codes) in `tests/goldens/*.golden`. A change that moves one must say why.
+Re-bless on purpose, then review the diff:
+
+```bash
+FREEMKV_BLESS_GOLDENS=1 cargo test --lib parity_
+git diff tests/goldens
+```
+
 ## Code style
 
 - Follow Rust conventions (`cargo fmt`, `cargo clippy`)