test: constrain the DiscStream loss surface and the empty-title guards

Second mutation pass over src/mux/. 26 survivors killed, no production
change. Verified on HEAD before landing: each mutation below passes all
1,237 mux tests unmutated-suite.

The priority item was the honest-loss-reporting surface. Both
DiscStream::errors and DiscStream::lost_bytes could return a constant
with nothing failing — a rip that lost sectors would report zero loss
to the caller. This project has already shipped one defect of that
shape (a total decryption failure reported as an empty title, exit 0).
Driven now through two short-read fills so both land on values that are
neither 0 nor 1 and differ from each other; no constant and no field
swap survives.

MkvStream::finish -> Ok(()) also survived. MkvMuxer::finish has the
zero-frame MkvInvalid guard and two tests cover it, but the Stream
wrapper above it could return Ok unconditionally and bypass the guard
entirely — the empty-title defence was one layer thinner than it looked.

au_assembly: pinned au_opener_from behaviourally to the normative byte
values for all four modes, with negative cases for codes that are
explicitly not openers (MPEG-2 slice 0x01..0xAF, user data 0xB2,
extension 0xB5, sequence end 0xB7 per 13818-2 Table 6-1; VC-1
0x0A/0x0B/0x0C; H.264 SPS/PPS/IDR-slice). au_assembly and codec/ hold
independent copies of these constants; they agree today, and comparing
constants would not catch logic drifting apart, so both sides are now
pinned to the spec instead of to each other.

demux_sink::sanitize: every filename component demux:// writes comes
from disc-controlled text, so the path-separator arm is a traversal
guard. Deleting it now fails, including an end-to-end case where
base = "../evil/Title" must produce exactly one file inside the
chosen directory.

stts_and_ctts_expand renamed to stts_expands_runs_to_per_sample_deltas_in_order
and given runs with distinct deltas AND distinct lengths. Its old name
claimed ctts coverage it never had, which is why the composition-time
chain went unconstrained for eight rounds; the doc comment now points
at the tests that do cover ctts.

Correction to the previous pass: codec/truehd.rs flush -> vec![] IS
equivalent. Applied it, full mux suite green. TrueHD buffers across PES
but parse emits every complete unit immediately, so a residual buffer
at EOF is a truncated access unit and is correctly discarded. The
vec![Default::default()] variants are genuinely different and are
killed.

Deliberately not constrained: mkv::set_opening_capture (diagnostics
behind a process-global tracing check, flaky under the parallel
runner), and the three stdio.rs header paths (StdioStream holds
concrete io::Stdin/Stdout and cannot be driven without a production
refactor to injectable Read/Write).

src/mux/codec/mpegaudio.rs

@@ -287,4 +287,36 @@ mod tests {
             "next frame keeps its own PTS"
         );
     }
+
+    /// This parser is self-framing at PES granularity: `parse` emits (or drops)
+    /// every packet immediately and buffers nothing, so end-of-stream has
+    /// nothing left to hand over. A `flush` that manufactured a frame would
+    /// append a zero-length block at PTS 0 AFTER a track that has already run to
+    /// its real end — a Matroska Block whose timestamp jumps backwards past every
+    /// cluster before it (RFC 9559 §5.1.3.2 Blocks are relative to their
+    /// cluster's timestamp; a phantom 0 lands in the wrong cluster entirely) and
+    /// an empty audio frame no decoder can consume.
+    #[test]
+    fn flush_adds_no_phantom_frame_after_the_last_real_packet() {
+        let mut p = MpegAudioParser::new();
+        let mut emitted = Vec::new();
+        emitted.extend(p.parse(&make_pes(mp3_frame(400), Some(90_000))));
+        emitted.extend(p.parse(&make_pes(mp3_frame(400), Some(180_000))));
+        // An invalid header (version field 01 = reserved) is dropped, not buffered.
+        emitted.extend(p.parse(&make_pes(vec![0xFF, 0xEB, 0x90, 0x00, 0xAA], Some(270_000))));
+        assert_eq!(emitted.len(), 2, "two valid packets out, one dropped");
+        assert_eq!(p.dropped_frames(), 1);
+
+        let tail = p.flush();
+        assert!(
+            tail.is_empty(),
+            "nothing is buffered past the last packet; flush produced {:?}",
+            tail.iter()
+                .map(|f| (f.pts_ns, f.data.len()))
+                .collect::<Vec<_>>()
+        );
+        // Total frame count over the whole stream equals the valid input count —
+        // a manufactured tail frame would break this even if it were non-empty.
+        assert_eq!(emitted.len() + tail.len(), 2);
+    }
 }