audit: fix AU mark-field loss, VTI tie determinism, and mark/perf issues

Round-4 findings from the 10-phase release audit (the first fully clean
round; it dug into the new #22/#18 refactor code):

- AuAssembler closed each AU from only the FRONT mark's fields, so when
  one PES fragment carried the source and a later fragment of the same AU
  carried the PTS, the second field was dropped — a regression vs the old
  separate pts/source mark deques. Now merge the first Some of each field
  across all in-range marks.
- parse_vti_clip_order picked the largest residue bucket with
  HashMap::into_values().max_by_key(), nondeterministic on a size tie
  (randomized HashMap iteration) — could select a different clip table
  run-to-run. Break ties by smallest offset.
- Bound the marks/disc_marks deques (MAX_MARKS): the buf-size cap prunes
  marks only when bytes accumulate, so a run of zero-length timed
  fragments could grow them without bound on hostile input.
- Add push_owned so the PS path moves the PES payload into a passthrough
  AU with no copy (MPEG-2 video + all audio), removing a per-PES
  malloc+memcpy the refactor had introduced on the DVD path.
- Back-patch the MKV duration from the block END (start + its own
  duration) so it covers the final frame instead of understating by one.
- Add direct tests for the MKB record-framing walker; drop a stale
  drain_complete_aus doc comment left on process_au.

src/mux/codec/mpeg2.rs

@@ -174,9 +174,6 @@ impl Mpeg2Parser {
         parse_aspect_ratio(hdr)
     }
 
-    /// Drain every complete access unit from `buf`, returning one Frame each.
-    /// When `force` is true (EOF flush, or buffer-cap backstop) the trailing
-    /// in-progress access unit is emitted even without a following boundary.
     /// Process one reassembled access unit (from [`AuAssembler`]): decode its
     /// per-picture coding info, capture a new sequence header, and buffer the
     /// picture into the current GOP for display-order timestamping. The AU's