Make iso:// a destination for any image source, not just a drive

Writing an iso:// meant a raw sector copy off a drive, so an existing
image could only ever be a source. Decrypting one you already had meant
finding the disc again.

The engine's copy is the recovery path — mapfile, multipass, damage-jump,
auto-resume — and all of it exists because optical media returns read
errors. A file does not, so a non-drive source gets write_image instead:
sectors in, bytes out, once, no recovery machinery. Keeping them apart is
not just tidiness. The mapfile identity check compares AACS unit keys and
the VID, both empty for an already-decrypted source, so identity passes
for any such source — a second run with different input to the same
output path would resume over the previous image and report success.

A short read is an error rather than a zero-fill: padding a truncated
source yields an image that looks complete and is not, which is the worst
outcome for a copy someone means to keep.

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [1.6.1]
 
+### Added
+
+- **An existing disc image can now be decrypted without the disc.**
+  `iso://In.iso iso://Out.iso` writes a decrypted image from an encrypted one;
+  previously the only way to get a decrypted image was to rip the disc in a
+  drive. Ripping from a drive is unchanged and still uses the recovery path —
+  multi-pass retry, resume, damage handling — because that machinery exists for
+  media that returns read errors, which a file does not.
+
 ### Fixed
 
 - Chapter marks and title durations on NTSC DVDs ran roughly 0.1% short —