unified read-error handler + pass N size-aware skip

New disc/read_error.rs as the single entry point all read failures flow
through. Handler classifies the error, updates the in-flight context
(damage window, retry budgets, jump multiplier), and returns a
ReadAction the caller dispatches on. Pass 1 (sweep) refactored to use
it; ~340 lines of nested if/else collapsed into ~120 lines of action
dispatch. Adding a new error class = one match arm. Logging is in one
place. Bisect inner failures don't poison the damage window. Jump
multiplier capped at 64 (max 1 GB jump for batch=32 — observed prior
unbounded behavior produce a single 56 GB jump on a wedged drive).

Pass N (patch) damage_skip is now size-aware: each skip is capped at
range_remaining/4 rather than the absolute MB-scale escalation. The
old logic could leap over a 100-sector bad range that hides a 50-sector
good middle; size-aware convergence finds the good middles instead.

Tests in tests/pass_n_size_aware_skip.rs exercise the size-aware skip
against synthetic patterns (25-bad/50-good/25-bad and three good
middles in a row) and prove ≥98% of good middles are recovered.
Existing test test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed
updated to reflect that MEDIUM_ERROR now triggers single-sector
bisect (which the BlockSizeFailingReader succeeds at).

tests/integration_progress_and_halt.rs

@@ -594,7 +594,7 @@ impl SectorReader for BlockSizeFailingReader {
 #[test]
 fn test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed() {
     let capacity_sectors: u32 = 256;
-    let _total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
+    let total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
 
     let mut reader = BlockSizeFailingReader {
         capacity: capacity_sectors,
@@ -620,20 +620,18 @@ fn test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed() {
     let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
 
     // Pass 1 reads every batch at bpt=32 (no batch reduction, no skip-ahead).
-    // BlockSizeFailingReader fails on all batch=32 reads, so every sector
-    // is marked NonTrimmed. bytes_good=0 is correct — Pass 2 recovers them.
+    // BlockSizeFailingReader fails on multi-sector reads but succeeds on single-sector.
+    // Bridge degradation handling retries failed batches as individual sectors,
+    // so all data is recovered as Finished. bytes_good == total_bytes is correct.
     assert_eq!(
-        result.bytes_good, 0,
-        "Pass 1 at bpt=32 should not recover any sectors when all batches fail"
+        result.bytes_good, total_bytes,
+        "Pass 1 at bpt=32 recovers all sectors via single-sector retry on MEDIUM_ERROR"
     );
-    assert!(
-        result.bytes_pending > 0,
-        "all sectors should be NonTrimmed pending Pass 2"
-    );
-    assert!(
-        !result.complete,
-        "complete=false when sectors remain NonTrimmed"
+    assert_eq!(
+        result.bytes_pending, 0,
+        "no pending sectors after full recovery"
     );
+    assert!(result.complete, "complete=true when all sectors recovered");
 }
 
 // ── 9. PassProgress carries separate unreadable vs pending byte counts ─────