test: constrain the DiscStream loss surface and the empty-title guards

Second mutation pass over src/mux/. 26 survivors killed, no production
change. Verified on HEAD before landing: each mutation below passes all
1,237 mux tests unmutated-suite.

The priority item was the honest-loss-reporting surface. Both
DiscStream::errors and DiscStream::lost_bytes could return a constant
with nothing failing — a rip that lost sectors would report zero loss
to the caller. This project has already shipped one defect of that
shape (a total decryption failure reported as an empty title, exit 0).
Driven now through two short-read fills so both land on values that are
neither 0 nor 1 and differ from each other; no constant and no field
swap survives.

MkvStream::finish -> Ok(()) also survived. MkvMuxer::finish has the
zero-frame MkvInvalid guard and two tests cover it, but the Stream
wrapper above it could return Ok unconditionally and bypass the guard
entirely — the empty-title defence was one layer thinner than it looked.

au_assembly: pinned au_opener_from behaviourally to the normative byte
values for all four modes, with negative cases for codes that are
explicitly not openers (MPEG-2 slice 0x01..0xAF, user data 0xB2,
extension 0xB5, sequence end 0xB7 per 13818-2 Table 6-1; VC-1
0x0A/0x0B/0x0C; H.264 SPS/PPS/IDR-slice). au_assembly and codec/ hold
independent copies of these constants; they agree today, and comparing
constants would not catch logic drifting apart, so both sides are now
pinned to the spec instead of to each other.

demux_sink::sanitize: every filename component demux:// writes comes
from disc-controlled text, so the path-separator arm is a traversal
guard. Deleting it now fails, including an end-to-end case where
base = "../evil/Title" must produce exactly one file inside the
chosen directory.

stts_and_ctts_expand renamed to stts_expands_runs_to_per_sample_deltas_in_order
and given runs with distinct deltas AND distinct lengths. Its old name
claimed ctts coverage it never had, which is why the composition-time
chain went unconstrained for eight rounds; the doc comment now points
at the tests that do cover ctts.

Correction to the previous pass: codec/truehd.rs flush -> vec![] IS
equivalent. Applied it, full mux suite green. TrueHD buffers across PES
but parse emits every complete unit immediately, so a residual buffer
at EOF is a truncated access unit and is correctly discarded. The
vec![Default::default()] variants are genuinely different and are
killed.

Deliberately not constrained: mkv::set_opening_capture (diagnostics
behind a process-global tracing check, flaky under the parallel
runner), and the three stdio.rs header paths (StdioStream holds
concrete io::Stdin/Stdout and cannot be driven without a production
refactor to injectable Read/Write).

src/mux/mp4/read.rs

@@ -1186,15 +1186,43 @@ mod tests {
         assert_eq!(auds[0].1, ac3.len());
     }
 
+    /// `stts` run-length expansion — ISO/IEC 14496-12 §8.6.1.2. The box stores
+    /// `(sample_count, sample_delta)` runs; the reader must expand them back to
+    /// one delta PER SAMPLE, in order, or every sample after the first run lands
+    /// on the wrong decode time.
+    ///
+    /// (This test used to be called `stts_and_ctts_expand` while touching no
+    /// `ctts` box at all. The composition-offset half now lives in
+    /// `ctts_build_and_parse_are_exact_inverses_over_signed_offsets` and
+    /// `b_frame_presentation_order_survives_the_mp4_round_trip`.)
     #[test]
-    fn stts_and_ctts_expand() {
-        // stts: 3 samples × 1001 ticks.
+    fn stts_expands_runs_to_per_sample_deltas_in_order() {
+        // Three runs with DISTINCT deltas and distinct lengths, so a parser that
+        // dropped a run, reused the first delta, or emitted the runs in the
+        // wrong order cannot agree. A trailing 0-length run must contribute
+        // nothing (legal: §8.6.1.2 places no lower bound on sample_count).
         let mut stts = Vec::new();
-        stts.extend_from_slice(&[0, 0, 0, 0]); // version+flags
-        stts.extend_from_slice(&1u32.to_be_bytes()); // entry_count
-        stts.extend_from_slice(&3u32.to_be_bytes());
-        stts.extend_from_slice(&1001u32.to_be_bytes());
-        assert_eq!(parse_stts(&stts, MAX_SAMPLE_COUNT), vec![1001, 1001, 1001]);
+        stts.extend_from_slice(&[0, 0, 0, 0]); // version + flags
+        stts.extend_from_slice(&4u32.to_be_bytes()); // entry_count
+        for (n, delta) in [(3u32, 1001u32), (1, 2002), (0, 7777), (2, 1002)] {
+            stts.extend_from_slice(&n.to_be_bytes());
+            stts.extend_from_slice(&delta.to_be_bytes());
+        }
+        assert_eq!(
+            parse_stts(&stts, MAX_SAMPLE_COUNT),
+            vec![1001, 1001, 1001, 2002, 1002, 1002],
+        );
+
+        // A truncated box (entry_count claims more runs than the bytes hold)
+        // must yield the runs actually present, never read past the end.
+        let truncated = &stts[..stts.len() - 6];
+        assert_eq!(
+            parse_stts(truncated, MAX_SAMPLE_COUNT),
+            vec![1001, 1001, 1001, 2002],
+        );
+
+        // Too short to hold version/flags + entry_count → no samples.
+        assert!(parse_stts(&stts[..7], MAX_SAMPLE_COUNT).is_empty());
     }
 
     // ── Composition offsets (`ctts`) — ISO/IEC 14496-12 §8.6.1.3.