Fix rc5 audit findings: keydb doc, pipeline ordering, hot-loop Arc, tests

- keydb.rs: separate default_path()/no_home_dir() doc blocks; correct the
  false XDG lock-step claim (Linux write path uses $HOME, ignores
  XDG_CONFIG_HOME; read-side search also checks XDG_CONFIG_HOME).
- io/pipeline.rs: use Release/Acquire on the abandoned flag so a leaked
  consumer reliably skips close() on weak memory models (ARM64/POWER),
  not just x86 TSO.
- mux/disc.rs: cache the decrypt-loss Arc at construction; lost_bytes()
  no longer clones an Arc per frame on the mux hot path.
- disc/dvd.rs: assert display_aspect mapping for both 16:9 (PAL test) and
  4:3 (NTSC test).
- mux/resolve.rs: extract css_error_aborts() helper and unit-test the
  scrambled-but-uncracked CSS guard (Fix 6) incl. the --raw exemption.
- aacs/keys.rs: add unit tests for mkb_type_raw/mkb_type/mkb_is_uhd and
  MkbType (Category C 2.0 UHD, prerecorded 1.0, no-0x10-record None).
- release.yml: publish job needs [verify, test] so a failing test suite
  blocks crates.io publication.

src/mux/disc.rs

@@ -108,6 +108,11 @@ pub struct DiscStream {
     /// inline `decrypt::decrypt_sectors` step. `DecryptKeys::None`
     /// (raw / unencrypted disc) makes the decorator a pass-through.
     reader: DecryptingSectorSource<Box<dyn SectorSource>>,
+    /// Shared decrypt-loss counter, cloned once at construction from
+    /// `reader.decrypt_loss()`. `lost_bytes()` loads it directly so the
+    /// per-frame hot path performs no per-call `Arc::clone` (matching the
+    /// `PipelinedPesStream` pattern).
+    decrypt_loss: std::sync::Arc<std::sync::atomic::AtomicU64>,
     title: DiscTitle,
     /// Mirror of the keys handed in at construction. The decorator
     /// owns the cryptographic state; this field is kept for
@@ -253,12 +258,17 @@ impl DiscStream {
             _ => 1,
         };
 
+        // Wrap the input reader in DecryptingSectorSource so the internal
+        // fill_extents path sees plaintext bytes. For DecryptKeys::None
+        // (unencrypted / raw / test fixtures) the decorator is a pass-through.
+        let reader = DecryptingSectorSource::new(reader, decrypt_keys.clone());
+        // Clone the shared loss counter once here so `lost_bytes()` never
+        // clones an Arc per frame on the mux hot path.
+        let decrypt_loss = reader.decrypt_loss();
+
         Self {
-            // Wrap the input reader in DecryptingSectorSource so the
-            // internal fill_extents path sees plaintext bytes. For
-            // DecryptKeys::None (unencrypted / raw / test fixtures)
-            // the decorator is a pass-through.
-            reader: DecryptingSectorSource::new(reader, decrypt_keys.clone()),
+            reader,
+            decrypt_loss,
             title,
             decrypt_keys,
             unit_align,
@@ -802,11 +812,8 @@ impl crate::pes::Stream for DiscStream {
         // them). Both are real missing content the abort gate must see; without
         // the decrypt term a partial key failure reports lost_bytes=0 and a rip
         // missing segments passes even under abort_on_lost_secs=0.
-        self.lost_bytes.saturating_add(
-            self.reader
-                .decrypt_loss()
-                .load(std::sync::atomic::Ordering::Relaxed),
-        )
+        self.lost_bytes
+            .saturating_add(self.decrypt_loss.load(std::sync::atomic::Ordering::Relaxed))
     }
 }
 

src/mux/resolve.rs

@@ -249,6 +249,17 @@ fn css_key_missing(raw: bool, has_css: bool, keys: &crate::decrypt::DecryptKeys)
     !raw && has_css && matches!(keys, crate::decrypt::DecryptKeys::None)
 }
 
+/// Scrambled-but-uncracked CSS guard (Fix 6). Returns `true` when decryption
+/// is requested (`!raw`) and the scan recorded a hard CSS error
+/// (`has_css_error` — `disc.css_error.is_some()`), meaning the content is
+/// scrambled but no title key was recovered (so `disc.css` is `None`). Muxing
+/// that case would pass scrambled MPEG through as plaintext, so the caller
+/// fails fast with [`Error::CssKeyMissing`]. `--raw` is exempt (skips
+/// decryption), so it always returns `false`.
+fn css_error_aborts(raw: bool, has_css_error: bool) -> bool {
+    !raw && has_css_error
+}
+
 /// Open a PES input stream (produces PES frames).
 pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::Stream>> {
     let parsed = parse_url(url);
@@ -290,7 +301,7 @@ pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::S
             // as "unencrypted" and the scrambled MPEG would mux as plaintext
             // garbage at exit 0. Surface the recorded hard error instead.
             // `--raw` skips decryption, so it is exempt.
-            if !opts.raw && disc.css_error.is_some() {
+            if css_error_aborts(opts.raw, disc.css_error.is_some()) {
                 return Err(crate::error::Error::CssKeyMissing.into());
             }
             // No-key guard: if decryption is requested (not --raw) and the disc
@@ -658,6 +669,7 @@ fn build_m2ts_pipeline<R: std::io::Read + Send + 'static>(
 mod tests {
     use super::StreamUrl;
     use super::aacs_key_missing;
+    use super::css_error_aborts;
     use super::css_key_missing;
     use super::parse_url;
     use super::validate_network_addr;
@@ -779,6 +791,18 @@ mod tests {
         assert!(!css_key_missing(false, false, &DecryptKeys::None));
     }
 
+    #[test]
+    fn css_error_field_aborts_unless_raw() {
+        // Fix 6: a scrambled-but-uncracked DVD records a hard error in
+        // `disc.css_error` (css is None). With decryption requested the
+        // input() guard must abort with CssKeyMissing.
+        assert!(css_error_aborts(false, true));
+        // --raw skips decryption → never aborts on the css_error field.
+        assert!(!css_error_aborts(true, true));
+        // No recorded css_error → the guard does not fire.
+        assert!(!css_error_aborts(false, false));
+    }
+
     #[test]
     fn raw_never_aborts() {
         // --raw skips decryption — must never hit the no-key abort, even on an