audit: bound DTS marks, align disc-format tree order, doc/test cleanups

Round-7 findings from the 10-phase release audit (no HIGH; convergence):

- Cap DtsParser.pts_marks (MAX_PTS_MARKS): a run of zero-length timed PES
  packets grew no buffer bytes, so the drain_front mark-prune never ran —
  the deque could accumulate without bound on hostile PS input.
- detect_disc_format tested HVDVD_TS before BDMV while the title-scan
  dispatch tests BDMV first, so a disc with both trees would be classified
  HD-DVD but enumerated as Blu-ray. Align both to BDMV → HVDVD_TS →
  VIDEO_TS.
- Document why the DTS new-PES re-base can emit a locally-decreasing PTS
  (the muxer's block_ts applies the strictly-monotonic audio nudge, tested
  in mkv.rs) — this is by design, not a mux defect.
- Fix stale aacs/keys.rs comment references (functions moved to
  aacs/inf.rs / aacs::resolve/derive in the module split).

src/aacs/resolve.rs

@@ -1345,7 +1345,7 @@ mod tests {
     }
     #[test]
     fn stride_v10_is_48_v20_is_64_and_picks_distinct_keys() {
-        // AACS 1.0 stride = 48, AACS 2.0/2.1 stride = 64 (keys.rs:30-35).
+        // AACS 1.0 stride = 48, AACS 2.0/2.1 stride = 64 (aacs/inf.rs).
         // Lay keys at 64-byte stride. Parsing at V20 stride must pick exactly
         // those keys; parsing the SAME bytes at V10 (48) stride would read the
         // wrong (intermediate) bytes for key 2 onward — proving the stride
@@ -1447,7 +1447,7 @@ mod tests {
     }
     #[test]
     fn parse_unit_key_ro_cps_unit_numbers_are_1_based() {
-        // The disc's CPS unit numbers are emitted as (i+1) — keys.rs:162.
+        // The disc's CPS unit numbers are emitted as (i+1) — aacs/inf.rs.
         let data = build_unit_key_ro(3, 48);
         let p = parse_unit_key_ro(&data, AacsVersion::V10).unwrap();
         assert_eq!(
@@ -1936,7 +1936,7 @@ mod tests {
     //
     // The rc.6 E7017/E7022 split is also exercised end-to-end through the
     // `ensure_decryptable` gate in `disc/mod.rs`. These tests pin the
-    // *classifier* directly at the keys.rs seam and cover the branches the
+    // *classifier* directly at the aacs::resolve seam and cover the branches the
     // gate test does not: VID-present (must never be VidUnavailable), the
     // processing-keys-only material path, and the version dispatch / Ok path.
 

src/aacs/variant.rs

@@ -889,7 +889,7 @@ mod tests {
     fn mkb_records_matches_walk_mkb_framing() {
         // The lazy `mkb_records` iterator and the owning `walk_mkb` must agree on
         // (offset, type, len) for every record — they share the one framing
-        // walker, and every keys.rs MKB walk now relies on this equivalence.
+        // walker, and every aacs::resolve/derive MKB walk now relies on this equivalence.
         let mut mkb = vec![0x10, 0x00, 0x00, 0x06, 0xAA, 0xBB];
         mkb.extend_from_slice(&[0x05, 0x00, 0x00, 0x08, 1, 2, 3, 4]);
         mkb.extend_from_slice(&[0x00, 0x00, 0x00, 0x00, 0xFF]); // terminator + trailing