Harden 3D MVC mux: robustness + tests (audit round 1)

Triage of a 10-lens code audit of the 3D branch. Fixes for real defects;
rejected three spec false-positives that matched the ISO/IEC 14496-15
§7.6.2 record verbatim.

Robustness / correctness:
- Never panic when a title's only video is the MVC dependent view: the
  base is now the first NON-dependent video, so a dependent-only title
  sets up no merge (muxed as an ordinary track) instead of hitting an
  `expect` on the skipped track slot.
- Drop a per-frame BlockAdditional (BlockAddID=2) when the track declared
  no mvcC mapping (dependent params not captured before the header) — a
  plain block keeps the file conforming instead of an orphaned add.
- A non-keyframe MVC base frame always carries a ReferenceBlock (fall back
  to a 0 offset in the pre-first-keyframe corner) so it is never mistaken
  for a seek point.
- Reference the last keyframe on the PRIMARY video track only, so a
  secondary video track's keyframe can't become a cross-track reference.
- dep_by_pts overflow: bound BEFORE inserting so the just-arrived
  dependent survives the drift-clear; count a displaced duplicate-PTS
  dependent as an orphan instead of losing it silently.

API / docs:
- Fold write_frame_with_additional into write_frame(..., Option<&[u8]>)
  per the "no foo_with_X" convention.
- Fix mvc_params doc (StereoMode is intentionally not emitted); remove a
  stale PAT/PMT comment describing an approach that was never taken.

Tests: MVCDecoderConfigurationRecord over-length guards; write_int minimal
two's-complement widths; BlockGroup/BlockAdditions/BlockAdditional +
ReferenceBlock emission; additional dropped without a mapping; h264 MVC
passthrough keeps param sets in-band; extract_mvc_params no-panic on
truncated/empty input; pairing window + dep-overflow edges; no-panic on a
dependent-only title.

src/mux/ebml.rs

@@ -1004,6 +1004,31 @@ mod tests {
         assert_eq!(buf, [0x42, 0x86, 0x81, 0x00]);
     }
 
+    #[test]
+    fn write_int_minimal_two_complement_width() {
+        // ReferenceBlock (0xFB) signed offsets, minimal two's-complement width.
+        let enc = |v: i64| {
+            let mut b = Vec::new();
+            write_int(&mut b, REFERENCE_BLOCK, v).unwrap();
+            b
+        };
+        assert_eq!(enc(0), [0xFB, 0x81, 0x00], "0 -> 1 byte 0x00");
+        assert_eq!(enc(-1), [0xFB, 0x81, 0xFF], "-1 -> 1 byte 0xFF");
+        assert_eq!(enc(127), [0xFB, 0x81, 0x7F], "127 -> 1 byte");
+        assert_eq!(
+            enc(128),
+            [0xFB, 0x82, 0x00, 0x80],
+            "128 needs 2 bytes (0x80 alone is -128)"
+        );
+        assert_eq!(enc(-128), [0xFB, 0x81, 0x80], "-128 -> 1 byte 0x80");
+        assert_eq!(enc(-129), [0xFB, 0x82, 0xFF, 0x7F], "-129 needs 2 bytes");
+        // i64::MIN is the widest: 8 bytes, size 0x88.
+        let mn = enc(i64::MIN);
+        assert_eq!(mn[0], 0xFB);
+        assert_eq!(mn[1], 0x88);
+        assert_eq!(&mn[2..], &i64::MIN.to_be_bytes());
+    }
+
     // ============================================================
     // write_float — EBML floats here are always 8-byte IEEE-754 doubles,
     // big-endian (Matroska SamplingFrequency/Duration). size byte = 0x88.