verify: post-read decrypt-verify gate + libaacs-strict verify + audit fixes

Post-read verify gate (new src/disc/verify.rs): UnitVerifier buffers/aligns the disc-absolute read stream into clip-file 6144-byte units, then makes one decryptability() decision per unit (CPI gate -> held keys -> key_fetch -> strict TS). POST_READ_VERIFY const kill-switch; fail-safe contract (only ever downgrades units it is confident are undecryptable; every doubt skips). Hooked into Disc::sweep (producer observes ciphertext -> WorkItem::MarkBad after the Good, FIFO-ordered) and Disc::patch (post-loop reverify_iso reads recovered units whole from the patched ISO). extract::clip_layouts enumerates AACS clips for the gate.

Standards-correct AACS verify: aacs::unit_is_clean_ts is a strict port of libaacs _verify_ts (all 32 TS syncs, not a majority vote); decrypt_unit accepts a key only on it; the majority verify_ts is removed. Deleted the Disc::verify_clips post-pass bolt-on (its primitive is absorbed by the read-path gate).

libaacs/DVD audit fixes: content-cert bus_encryption flag now read from bit 7 (was bit 0 - defeated the bus-key fail-loud gate); cc_id read from offset 14; title_cps_unit range-validated + 1->0 index-converted per libaacs. Corrected attack_crib ("functionally-equivalent" not "exact" port) and read_disc_key (READ DVD STRUCTURE 0xAD, not REPORT KEY) doc comments.

Also includes accumulated uncommitted work: key-fetch seam and TrueHD/DTS audio fix.

src/css/auth.rs

@@ -280,9 +280,12 @@ fn bus_auth(drive: &mut Drive) -> Result<(u8, [u8; 5])> {
 
 // ── Step 2: Disc Key ──────────────────────────────────────────────────────
 
-/// Issue the disc-key REPORT KEY (READ DVD STRUCTURE, format 0x02) purely
-/// for the bus-auth unlock side effect. The returned block contents are
-/// not used — the descramble title key is recovered keylessly elsewhere.
+/// Issue READ DVD STRUCTURE format 0x02 (Copyright Information — opcode 0xAD,
+/// NOT the REPORT KEY 0xA4 disc-key block) purely for the bus-auth unlock side
+/// effect. The returned block contents are not used — the descramble title key
+/// is recovered keylessly elsewhere, so the genuine disc-key REPORT KEY is
+/// intentionally skipped. (If a drive is ever found where bus-auth alone does
+/// not open scrambled reads, a real REPORT KEY format 0x02 belongs here.)
 fn read_disc_key(drive: &mut Drive, agid: u8) -> Result<()> {
     let scsi = drive.scsi_mut();
 

src/css/stevenson.rs

@@ -225,7 +225,9 @@ fn descramble_matches(sector: &[u8], title: &[u8; 5], plain: &[u8]) -> bool {
 /// AttackPattern: find a repeating pattern just before the encrypted region
 /// and assume the plaintext at 0x80 continues it.
 ///
-/// Exact port of libdvdcss `AttackPattern` (css.c). Scans cleartext
+/// Functionally-equivalent port of libdvdcss `AttackPattern` (css.c) — finds the
+/// same periodic cribs on real DVD data, though its byte-comparison anchor
+/// differs from the C on phase-misaligned runs. Scans cleartext
 /// `sec[0x00..0x80]` for the longest run that repeats with a cycle length in
 /// 2..0x2F. If the run is long enough (`plen > 3` and at least two full
 /// cycles), the known plaintext at 0x80 is taken to be the periodic run