Decrypt is keymap-only: sweep/patch/extract, no AACS trial-decrypt

Every AACS decrypt now goes through the resolved key map (decrypt_sectors_
mapped): the map keys each content unit up front and a missing key fails at
resolve time. The old trial-decrypt path — try each held key per unit, keep
the first-tried plaintext on a miss — is gone; decrypt_sectors_impl's AACS
arm now fails loud (reaching it means a reader was built without its map,
which would silently apply a wrong key). CSS (self-descramble) and the clear
no-op path are unchanged.

Disc::sweep and Disc::patch resolve a whole-disc key map up front for a
decrypting pass (the fetch secures any missing CPS-unit key, fail-loud) and
decrypt via the map — clear nav/filesystem sectors are in no range and pass
through, so the separate content-range gate and the reactive per-unit
key-fetch recovery are no longer needed. extract_tree keys every unit with
the base Unit Key through the map (its encrypted-flag gate skips clear
files). Multipass sweeps stay --raw.

Removes the obsolete non-mapped-AACS trial/gate/recovery tests (the mapped
path and resolve fail-loud are tested directly).

src/disc/patch.rs

@@ -1329,24 +1329,33 @@ impl Disc {
         // PHYSICAL read success, not by decrypt structure: a re-read that returns
         // good bytes recovers the range; a read that errors leaves it NonTrimmed
         // for the next pass. (The old decrypt-VERIFY read gate was removed.)
-        let keys = if opts.decrypt {
+        let mut keys = if opts.decrypt {
             self.decrypt_keys()
         } else {
             crate::decrypt::DecryptKeys::None
         };
         let decrypt_is_aacs = matches!(keys, crate::decrypt::DecryptKeys::Aacs { .. });
+        // AACS decrypting patch: resolve the whole-disc key map up front and decrypt
+        // via the map (identical to `Disc::sweep`). CSS keeps the content-gated
+        // self-descramble path. (Multipass patch is `--raw`, so decrypt is a no-op.)
+        let key_map = if opts.decrypt && decrypt_is_aacs {
+            Some(std::sync::Arc::new(self.resolve_content_key_map(
+                reader,
+                &mut keys,
+                opts.key_fetch.as_ref(),
+            )?))
+        } else {
+            None
+        };
         let content_ranges = self.encrypted_content_ranges();
         let can_gate = !content_ranges.is_empty();
         let mut reader = {
             let mut dec = DecryptingSectorSource::new(reader, keys);
-            if opts.decrypt && can_gate {
+            if let Some(map) = key_map {
+                dec = dec.with_key_map(map);
+            } else if opts.decrypt && can_gate {
                 dec = dec.with_content_ranges(std::sync::Arc::from(content_ranges));
             }
-            if decrypt_is_aacs && opts.decrypt {
-                if let Some(cb) = &opts.key_fetch {
-                    dec = dec.with_key_fetch(cb.clone());
-                }
-            }
             dec
         };
         let reader = &mut reader;