0.18 round 1 polish: address libfreemkv code-review findings

Applies must-fix + in-scope should-fix items from the round-1 code
review:

- M1: FileSectorSource::open takes &Path (was &str — non-UTF-8 panic)
- M2: drop FileSectorSource's BufReader (defeated by absolute seeks)
- M3: WritebackFile Drop impl finalises the writeback pipeline
- M4: Pipeline::finish preserves panic payload in error message
- M5: pes::Stream is left without a : Send supertrait — concrete
  in-tree impls (MkvStream, M2tsStream) hold Box<dyn Read> /
  Box<dyn Write> trait objects that aren't Send, so the simple
  trait tightening would cascade into a wider Send audit. Per the
  review's escape clause the FrameSource blanket impl keeps its
  T: Send bound and the constraint is documented loudly there.
- S6: document Pipeline::send post-Flow::Stop semantics
- S9: truncate stale Stream docs (E9001/E9000 was runtime-only)
- S10: document WritebackPipeline.fd lifetime invariant
- S11: pub use pes::Stream as PesStream to disambiguate from
  disc::Stream codec enum at crate root
- S12: rename DEFAULT_DEPTH → DEFAULT_PIPELINE_DEPTH; add
  WRITE_THROUGH_DEPTH constant
- N14: drop Halt's Default derive (redundant with Halt::new)
- N17: Pipeline::spawn propagates thread-spawn error instead of expect
- N19: deprecation since = "0.18.0" (was "0.18.0-dev", non-conventional)
- N21: rename Apply enum to Flow

Deferred to follow-up commits: SectorReader/SectorSource competition
(migration commit), WritebackFile::create/open orphans (migration
commit), AACS round-trip test (design doc defers), various nits.

See freemkv-private/memory/0_18_redesign.md.

Single contributor: MattJackson.

src/halt.rs

@@ -19,7 +19,12 @@ use std::sync::atomic::{AtomicBool, Ordering};
 /// Clones share the same underlying flag. `cancel()` is one-way; there is
 /// no `reset()` by design — construct a fresh `Halt` for a fresh
 /// operation.
-#[derive(Clone, Debug, Default)]
+///
+/// Construct with [`Halt::new`]. We intentionally don't derive
+/// `Default` — `Halt::new()` is more discoverable, matches the
+/// stdlib `Mutex::new` / `Arc::new` convention, and keeps the
+/// uncancelled-by-construction invariant in one named place.
+#[derive(Clone, Debug)]
 pub struct Halt(Arc<AtomicBool>);
 
 impl Halt {
@@ -99,9 +104,4 @@ mod tests {
         assert!(h.is_cancelled());
     }
 
-    #[test]
-    fn default_impl_is_uncancelled() {
-        let h = Halt::default();
-        assert!(!h.is_cancelled());
-    }
 }