Fix audit findings: SCSI constants, sg_io_hdr assert, handshake cap, sector overflow check

- Replace magic SCSI opcodes with named constants (S2)
- Add compile-time sg_io_hdr size assertion — 88 bytes on 64-bit (W2)
- Cap handshake cert attempts at 16 (W8)
- Validate IsoSectorReader/FileSectorReader against u32 overflow for >8TB (S8)
- encrypt.rs: limit host cert loop iterations

src/scsi/linux.rs

@@ -40,6 +40,13 @@ struct sg_io_hdr {
     info: u32,
 }
 
+// Compile-time validation: sg_io_hdr must match the kernel's layout.
+// 64 bytes on 64-bit, 44 bytes on 32-bit (pointer-size dependent).
+#[cfg(target_pointer_width = "64")]
+const _: () = assert!(std::mem::size_of::<sg_io_hdr>() == 88);
+#[cfg(target_pointer_width = "32")]
+const _: () = assert!(std::mem::size_of::<sg_io_hdr>() == 64);
+
 pub struct SgIoTransport {
     fd: i32,
 }