Fix rc5 audit findings: keydb doc, pipeline ordering, hot-loop Arc, tests

- keydb.rs: separate default_path()/no_home_dir() doc blocks; correct the
  false XDG lock-step claim (Linux write path uses $HOME, ignores
  XDG_CONFIG_HOME; read-side search also checks XDG_CONFIG_HOME).
- io/pipeline.rs: use Release/Acquire on the abandoned flag so a leaked
  consumer reliably skips close() on weak memory models (ARM64/POWER),
  not just x86 TSO.
- mux/disc.rs: cache the decrypt-loss Arc at construction; lost_bytes()
  no longer clones an Arc per frame on the mux hot path.
- disc/dvd.rs: assert display_aspect mapping for both 16:9 (PAL test) and
  4:3 (NTSC test).
- mux/resolve.rs: extract css_error_aborts() helper and unit-test the
  scrambled-but-uncracked CSS guard (Fix 6) incl. the --raw exemption.
- aacs/keys.rs: add unit tests for mkb_type_raw/mkb_type/mkb_is_uhd and
  MkbType (Category C 2.0 UHD, prerecorded 1.0, no-0x10-record None).
- release.yml: publish job needs [verify, test] so a failing test suite
  blocks crates.io publication.

.github/workflows/release.yml

@@ -42,10 +42,13 @@ jobs:
   # crates.io publish is an INDEPENDENT job: it serves EXTERNAL consumers only.
   # The freemkv binaries no longer depend on it (they git-tag-pin libfreemkv via
   # a committed [patch.crates-io]), so this publish runs in parallel with their
-  # release builds rather than gating them. It only `needs: verify` (the version
-  # check) — NOT `test` — so publish isn't serialized behind the test suite.
+  # release builds rather than gating them. It `needs: [verify, test]` so a
+  # failing test suite still blocks publication to crates.io — external
+  # consumers who `cargo add libfreemkv` must never receive a release whose
+  # tests were failing. (The two upstream jobs run in parallel, so this gate
+  # does not serialize publish behind test beyond their own completion.)
   publish:
-    needs: verify
+    needs: [verify, test]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5