aacs: libredrive raw-read VID path + revert v0.25.9 built-ins + walker fix follow-through

Three coherent threads landing for v0.25.11:

1. Libredrive raw-read VID path. When Mt1959::do_unlock sees both the
   MMkv active-mode marker at [12..16] and the LbDr mode-ID marker at
   [16..20], Drive::is_libredrive_active() returns true and
   do_handshake skips the AACS cert dance — VID is retrieved via
   READ_DISC_STRUCTURE format 0x80 with AGID=0 and bus encryption is
   already off. This unblocks UHD ripping on drives whose leaked host
   cert is on the AACS HRL.

   - platform/mt1959/mod.rs: detection + active flag + 4 unit tests.
   - platform/mod.rs: PlatformDriver::is_libredrive_active trait method.
   - drive/mod.rs: Drive::is_libredrive_active accessor.
   - disc/encrypt.rs: do_handshake branches on the flag; new
     read_volume_id_libredrive helper. Return type widened to
     (Option<HandshakeResult>, Option<Error>) so callers see which
     specific failure happened.
   - disc/mod.rs: scan_with plumbs the new tuple through and preserves
     handshake errors as disc.aacs_error.

2. Revert v0.25.9 built-in AACS keys + plugin slot. Single source of
   AACS truth: keydb.cfg. The compiled-in DKs/PKs were a slim
   convenience that didn't move the hard problem (no v77+ DKs) and
   added a maintenance surface. Plugin slot was overlapping
   functionality with the main keydb.

   - Deleted src/aacs/builtin_keys.rs (4 DKs + 3 PKs).
   - Removed KeyDb::with_builtins, load_or_builtins, merge_from,
     merge_local_plugin, local_plugin_path, internal dedup helpers.
     KeyDb::empty kept for unit-test use.
   - KeyDb::load reverts to pre-0.25.9 form: read file or return I/O
     error; no fallback.
   - disc::encrypt::resolve_encryption keydb_path back to required
     (&Path), not Option<&Path>.
   - disc::scan_with surfaces KeydbLoad { path: "<no keydb in search
     paths>" } sentinel when encrypted + no keydb — same sentinel
     autorip's message switch already handles.
   - CSS player keys in src/css/auth.rs stay compiled in; they're
     1999-era public inputs separate from AACS and pre-date the 0.25.9
     additions.

3. Walker fix follow-through (libaacs-parity validate_processing_key,
   cvalues 0x07-then-0x05 preference, path-2/3/4 short-circuit on
   zero VID) + NIST AES-CMAC KAT + VID MAC round-trip / mutation /
   zero-rejection tests.

5 new Error variants for finer-grained AACS failure reporting:
AacsHostCertRejected (E7015), AacsLibredriveUnsupported (E7016),
AacsVidUnavailable (E7017), AacsMkUnavailable (E7018),
AacsVukNotInKeydb (E7019). Lets CLIs/UIs render which piece of the
AACS chain failed instead of always saying "no keys."

CLAUDE.md

@@ -28,21 +28,19 @@ The library contains ZERO user-facing English text. All errors use numeric codes
 
 ## AACS key sources
 
-Three additive layers, loaded in this order:
+Single source: `keydb.cfg`. Located at `~/.config/freemkv/keydb.cfg` by
+default, or pointed at via `ScanOptions::keydb_path`. The file holds
+all DKs, PKs, host certs, and per-disc VUK entries. No keys are
+compiled into the binary.
 
-1. **Built-in keys** (compiled in). Cover DVDs (CSS) and Blu-rays (AACS 1.0)
-   across the public MKB range. No external file required for those discs.
-2. **Main `keydb.cfg`** at `~/.config/freemkv/keydb.cfg` (or via
-   `ScanOptions::keydb_path`). Required for UHD (AACS 2.0 / 2.1) — supplies
-   per-disc VUKs / media keys. Optional for DVD/BD.
-3. **Operator plugin** at `~/.config/freemkv/local_keys.cfg`. Same syntax as
-   `keydb.cfg`; merged additively on top of the built-ins and the main keydb.
-   For operators who derive their own device keys, processing keys, or VUKs.
+CSS player keys (DVD) remain compiled in — they're 1999-era public
+inputs separate from the AACS key pipeline and have always lived in
+`src/css/auth.rs`.
 
-The library MUST NOT treat a missing `keydb.cfg` as fatal — only as
-"no UHD-specific keys available." DVD and BD decryption proceeds from
-built-ins. Error `E7000` fires only when a disc actually needs keys
-the library does not have.
+The library treats a missing `keydb.cfg` for an AACS-encrypted disc as
+`Error::KeydbLoad` with the sentinel path `<no keydb in search paths>`.
+CLIs render this as "no KEYDB.cfg found"; consumers can disambiguate
+on the sentinel string.
 
 ## macOS IOKit transport