Fix audit findings: SCSI constants, sg_io_hdr assert, handshake cap, sector overflow check

- Replace magic SCSI opcodes with named constants (S2)
- Add compile-time sg_io_hdr size assertion — 88 bytes on 64-bit (W2)
- Cap handshake cert attempts at 16 (W8)
- Validate IsoSectorReader/FileSectorReader against u32 overflow for >8TB (S8)
- encrypt.rs: limit host cert loop iterations

src/disc/encrypt.rs

@@ -25,7 +25,8 @@ impl Disc {
         let keydb_path = opts.resolve_keydb()?;
         let keydb = KeyDb::load(&keydb_path).ok()?;
 
-        for hc in &keydb.host_certs {
+        const MAX_CERT_ATTEMPTS: usize = 16;
+        for hc in keydb.host_certs.iter().take(MAX_CERT_ATTEMPTS) {
             match aacs::handshake::aacs_authenticate(session, &hc.private_key, &hc.certificate) {
                 Ok(mut auth) => {
                     let volume_id = match aacs::handshake::read_volume_id(session, &mut auth) {