fix(session): delete two dead accessors, make into_drive fallible

drive() and drive_mut() had ZERO callers — not in libfreemkv, freemkv,
autorip, bdemu, keysources or kdb. Deleted rather than converted: dead
public API that panics is not an API worth preserving the shape of.

into_drive() had two callers and now returns Result. The empty-slot
state is reachable through ordinary public use — stage_drive_as_reader
moves the drive into the reader slot, and calling into_drive twice moves
it out — so the panic was not guarding a caller error. identify() was
converted for exactly this reason in this same release; the fix went to
one of four public sinks and the other three were left.

I deferred this on the assumption the blast radius was large. It was
three call sites. Checking beats assuming.

Also fixes a REAL FLAKE in the gate, which is worth more than the above.
resolve_vid_only_bus_key_gate_reports_true_has_volume_id... failed about
one full-suite run in ten while passing every time in isolation. It
installed a capturing tracing subscriber to read back the has_volume_id
field of a warn.

That cannot be made reliable: dispatcher::set_default is THREAD-LOCAL
while tracing's callsite-interest cache is GLOBAL. The original author
knew, and called rebuild_interest_cache() — necessary but not
sufficient. I first serialised every capture in the crate behind one
lock (harness::with_captured_tracing, which also removed the same
hand-rolled dance from three other sites). Still 1-in-10, because the
cache can be re-evaluated against the process-default dispatch rather
than the thread-local one.

So the predicate is now a named function, handshake_has_volume_id, and
the test asserts the VALUE. A boolean does not need a subscriber to
check. The gate's hard-error behaviour keeps its own test.

Measured: 14 consecutive full-suite runs, 2994 passed, 0 failed.

A flaky gate is worse than a missing one — every green after it means
less, and this one had been eroding trust in the whole suite.

src/disc/pgs_forced_probe.rs

@@ -1496,7 +1496,10 @@ mod tests {
 
         // Conclusive: one exactly-sized read, extent read to its end, no stall.
         let conclusive_count = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        tracing::subscriber::with_default(ScanDebugCounter(conclusive_count.clone()), || {
+        // Serialised crate-wide — see `harness::with_captured_tracing`. These
+        // race the capture in disc/encrypt.rs otherwise: the dispatch is
+        // thread-local but the callsite-interest cache is global.
+        crate::harness::with_captured_tracing(ScanDebugCounter(conclusive_count.clone()), || {
             let mut reader = TsReader {
                 data: ts_stream(pid, &pcs_display(true)),
                 pos: 0,
@@ -1516,7 +1519,7 @@ mod tests {
 
         // Inconclusive: dies mid-title with a read error → ReadFailed.
         let truncated_count = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        tracing::subscriber::with_default(ScanDebugCounter(truncated_count.clone()), || {
+        crate::harness::with_captured_tracing(ScanDebugCounter(truncated_count.clone()), || {
             let mut reader =
                 PartialTsReader::new(ts_stream(pid, &pcs_display(true)), ThenWhat::Error);
             let mut title = multi_read_pgs_title(pid, false);