1.2.0: single MKB framing walker + AACS resolve hardening

- mkb_records() as the one record-framing iterator; rebuild walk_mkb,
  find_record_body, mkb_find_subdiff_records, mkb_content_len, mkb_version,
  mkb_type_raw, mkb_find_mk_dv on it (D4).
- resolve_vid_only / read_aacs_version default to UHD (+warn) on a missing
  content cert instead of BD; route MKB through bounded read_mkb_content.
- AacsVersion major()/from_major() + AACS_MAJOR_BD/UHD as the stride source;
  table + stride-discriminating regression tests.
- read_encrypted_units probes 8 evenly-spaced points per extent (off-midpoint
  scrambled content now sampled); decrypt source-zero mask uses PKT.

src/aacs/decrypt.rs

@@ -283,7 +283,7 @@ pub fn decrypt_unit(unit: &mut [u8], unit_key: &[u8; 16]) -> bool {
     // non-zero (real ciphertext that won't decrypt) → still rejected.
     const PKT: usize = BD_SOURCE_PACKET_BYTES; // 192
     let npkt = ALIGNED_UNIT_LEN / PKT;
-    let mut pad = [false; ALIGNED_UNIT_LEN / 192];
+    let mut pad = [false; ALIGNED_UNIT_LEN / PKT];
     for (p, slot) in pad.iter_mut().enumerate().take(npkt) {
         let off = p * PKT;
         *slot = unit[off..off + PKT].iter().all(|&b| b == 0);