libfreemkv: 10-phase release audit fixes (v1.5.2..HEAD)

Multi-round audit of the decrypt/AACS/mux-codec refactor. Fixes, in
descending severity:

- mux/mp4/read.rs: bound untrusted-input allocations. `sample_budget`
  now also capped by file_len (a fixed-size stsz claiming count=u32::MAX
  can't inflate the Vec<SampleRef> past the file's own size); trak scan
  capped at MAX_TRACKS matches; find_box() takes only the first match
  (cap=1) instead of materializing every match. Removes dead find_boxes
  wrapper.
- disc/mod.rs: merge_content_key_ranges now UNIONS same-key overlapping
  ranges (coverage-preserving) instead of dropping the non-overlapping
  tail, which silently left encrypted LBAs uncovered -> ciphertext
  passthrough in the whole-disc sweep/patch map. Different-key overlap
  (malformed) still dropped to keep the set disjoint.
- sector/decrypting.rs: remove dead unit_key_idx field + with_unit_key_idx
  setter (vestigial from the pre-keymap trial-decrypt design; AACS is
  map-only now). Fix stale docs.
- decrypt.rs / resolve.rs / error.rs / extract.rs: doc/comment drift from
  the refactor (AacsKeyMap positive-map semantics, resolve_mux_key_map doc
  reattachment, decrypt_sectors_in_content legacy-alias, E_MP4_INVALID
  meaning, multi-CPS orphan by-design note).

Test coverage (all mutation-verified real):
- DTS NeedMore force-flush buffer bound; FLAC/MPEG-audio PTS carry-forward;
  mp4 mdhd timescale=0 divide-by-zero guard, MAX_TRACKS cap, sample-count
  file_len bound, MAX_ALLOC_BYTES cap under inflated file_len.
- resolve_fmts_key_map: extracted filter_addressable_segments,
  resolve_tie_phase, fill_base_key_gaps as pure behavior-preserving
  helpers, each unit-tested (segment filter, phase-tie arms, gap-fill
  gaplessness over every extent).

src/disc/extract.rs

@@ -202,6 +202,13 @@ impl Disc {
         //   real sample from it), up front before the decorator takes the reader. A
         //   content unit whose key the pool lacks fails loud at resolve (extract has
         //   no CPS/forensic fetch source), never emits a wrong-key garble.
+        //
+        //   KNOWN LIMITATION (by design): an orphan encrypted clip on a multi-CPS
+        //   disc — referenced by no playlist, so in no title extent — is in no range
+        //   and passes through as ciphertext. There is no correct key to apply (its
+        //   CPS unit is unknown without a playlist reference), and blind trial-decrypt
+        //   is exactly what this keymap-only model removes. Single-CPS is unaffected
+        //   (the blanket key-0 map above covers orphans).
         let key_map =
             match &base_keys {
                 DecryptKeys::Aacs { unit_keys, .. } if unit_keys.len() <= 1 => {