1.2.0: single MKB framing walker + AACS resolve hardening

- mkb_records() as the one record-framing iterator; rebuild walk_mkb,
  find_record_body, mkb_find_subdiff_records, mkb_content_len, mkb_version,
  mkb_type_raw, mkb_find_mk_dv on it (D4).
- resolve_vid_only / read_aacs_version default to UHD (+warn) on a missing
  content cert instead of BD; route MKB through bounded read_mkb_content.
- AacsVersion major()/from_major() + AACS_MAJOR_BD/UHD as the stride source;
  table + stride-discriminating regression tests.
- read_encrypted_units probes 8 evenly-spaced points per extent (off-midpoint
  scrambled content now sampled); decrypt source-zero mask uses PKT.

src/disc/encrypt.rs

@@ -327,10 +327,14 @@ impl Disc {
             .as_deref()
             .and_then(aacs::parse_content_cert);
         let bus_encryption = cc.as_ref().map(|c| c.bus_encryption).unwrap_or(false);
+        // No-cert default = UHD (V20 stride), matching `read_aacs_version` so the
+        // scanned `AacsState.version` and the out-of-band fetch agree. A wrong
+        // stride on the main resolve path fails loudly (sample validation) rather
+        // than silently, so the conservative V20 default is safe here too.
         let version = cc
             .as_ref()
             .map(|c| c.version.major())
-            .unwrap_or(aacs::AACS_MAJOR_BD);
+            .unwrap_or(aacs::AACS_MAJOR_UHD);
 
         // OEM bus-key gate (wrong-keys guard). A bus-encrypted disc (Content
         // Certificate bus-encryption bit set) still carries bus encryption on