unlock: Unlocker::unlock returns Unlocked { vid, read_data_key }

Generalize the unlock seam toward uniform unlockers (firmware / cert / CSS).
`unlock` now reports what it LEARNED — a Volume ID and/or an AACS bus key —
instead of just a Vid; libfreemkv files those onto the disc/drive in one
place, so a plugin never touches Disc. The hardware side-effect (extended
mode) still happens inside unlock. route_unlock walks the registry in
registration order (the single ordered place that decides run order); no
priority field. Firmware route reports {vid: Some, read_data_key: None}.

src/lib.rs

@@ -183,7 +183,7 @@ pub use identity::DriveId;
 // and registers it once at process start via `register_unlocker`. At
 // drive-prep the registry is walked in order; the first matching unlocker
 // runs, else the drive falls through to the host-cert AACS handshake.
-pub use unlock::{UnlockError, Unlocker, register_unlocker};
+pub use unlock::{UnlockError, Unlocked, Unlocker, register_unlocker};
 
 // ─── Decryption (AACS / CSS) ────────────────────────────────────────────────
 //