Decrypt is keymap-only: sweep/patch/extract, no AACS trial-decrypt

Every AACS decrypt now goes through the resolved key map (decrypt_sectors_
mapped): the map keys each content unit up front and a missing key fails at
resolve time. The old trial-decrypt path — try each held key per unit, keep
the first-tried plaintext on a miss — is gone; decrypt_sectors_impl's AACS
arm now fails loud (reaching it means a reader was built without its map,
which would silently apply a wrong key). CSS (self-descramble) and the clear
no-op path are unchanged.

Disc::sweep and Disc::patch resolve a whole-disc key map up front for a
decrypting pass (the fetch secures any missing CPS-unit key, fail-loud) and
decrypt via the map — clear nav/filesystem sectors are in no range and pass
through, so the separate content-range gate and the reactive per-unit
key-fetch recovery are no longer needed. extract_tree keys every unit with
the base Unit Key through the map (its encrypted-flag gate skips clear
files). Multipass sweeps stay --raw.

Removes the obsolete non-mapped-AACS trial/gate/recovery tests (the mapped
path and resolve fail-loud are tested directly).

src/disc/extract.rs

@@ -192,6 +192,16 @@ impl Disc {
         // borrowing wrapper (so the caller keeps `reader`), swap keys per CSS
         // VTS group via `set_keys`; AACS/None keep `base_keys` throughout.
         let mut dec = DecryptingSectorSource::new(Borrowed(reader), base_keys.clone());
+        // AACS decrypts via the key map. Extract reads arbitrary files (not resolved
+        // title extents), so key every unit with the disc's base Unit Key: the mapped
+        // decrypt applies it to encrypted units and passes clear filesystem/nav
+        // through (its encrypted-flag gate). Single-CPS is exact; a multi-CPS disc's
+        // secondary units are not separately keyed here (extract is not the mux path).
+        if matches!(base_keys, DecryptKeys::Aacs { .. }) {
+            dec = dec.with_key_map(std::sync::Arc::new(
+                crate::decrypt::AacsKeyMap::from_ranges(vec![(0, u32::MAX, 0)]),
+            ));
+        }
 
         let mut result = ExtractResult::default();
         let total_bytes = required;