mux: thread halt into live AACS key-map resolution; cover Session arm

Round-2 follow-ups to 6d6e60f (inline base-map resolve on the live
single-pass Session/Live mux arms).

Fix 1 (halt threading) — the inline resolve chain sampled ciphertext off
the LIVE drive with no cancel token, so an operator /api/stop during key
resolution was not honored (the FMTS probe can issue hundreds of reads,
each able to stall to the 60s SCSI recovery timeout — violating the
"don't hammer a struggling live drive" rule). Add an optional
`halt: Option<&Halt>` to `resolve_mux_key_map`, `resolve_fmts_key_map`,
`resolve_inline_base_map`, and `Disc::resolve_content_key_map`, and poll
it at each loop boundary (FMTS anchor + per-index probe loops, multi-CPS
extent loop) — returning Err(Halted) promptly. Live/Session arms pass the
driver's halt; sweep/patch pass their own token (via Halt::from_arc);
file-backed probe/ISO callers pass None. Tested with a pre-cancelled halt
(Err Halted, no extent sampling) and a None-halt no-abort case;
mutation-verified (dropping the extent-loop check → Ok, not Err).

Fix 2 (Session-arm coverage) — the MuxInput::Session arm ran the same
resolve→install→decrypt sequence as Live but had NO end-to-end test
(DiscSession only exposed open(), which needs live hardware). Add a
#[cfg(test)] DiscSession::from_parts_for_test (injected reader + scanned
disc, no Drive), an end-to-end AACS decrypt test through the Session arm
(mutation-verified: dropping with_key_map → mux aborts), and a
missing-reader clean-error (not panic) test.

Fix 3 (cleanups) — io_error_code: remove the unreachable typed-Error
downcast branch (From<Error> for io::Error stringifies; no path builds an
io::Error holding a typed Error), keeping the stringify parse is_halt /
is_skippable_title_stub rely on. Add a resolve_keys_for test covering the
largest-title sampling branch. Document the patch wedge-exit coverage gap
(TODO) in passn_handler_ab.rs.

src/error.rs

@@ -882,15 +882,13 @@ pub type Result<T> = std::result::Result<T, Error>;
 /// The numeric error code carried by an [`io::Error`](std::io::Error) that was
 /// produced from an [`Error`], or `None` if it carries none.
 ///
-/// Two shapes are recognised: an `io::Error` that still wraps the typed
-/// [`Error`] (via `io::Error::new(kind, Error)`), and the round-tripped form
-/// produced by [`From<Error> for io::Error`] whose message is the `Error`'s
-/// `E<code>[: …]` [`Display`](std::fmt::Display) string.
+/// [`From<Error> for io::Error`] is the ONLY path from a typed [`Error`] to an
+/// `io::Error` in this crate, and it stringifies (`io::Error::new(kind, msg)`
+/// where `msg` is the `Error`'s `E<code>[: …]` [`Display`](std::fmt::Display)
+/// string) rather than boxing the typed value — no code path constructs an
+/// `io::Error` that still holds a `crate::error::Error` via `get_ref`. So the
+/// only recognised shape is the round-tripped `E<code>` message prefix.
 fn io_error_code(e: &std::io::Error) -> Option<u16> {
-    // Direct: the io::Error still holds the typed Error.
-    if let Some(err) = e.get_ref().and_then(|r| r.downcast_ref::<Error>()) {
-        return Some(err.code());
-    }
     // Round-tripped: `From<Error> for io::Error` stringifies as "E<code>[: …]".
     let s = e.to_string();
     let digits = s.strip_prefix('E')?;