Read MKB_RO not the padded MKB_RW; keep VID when keydb is disabled

- read_aacs_inputs / read_aacs_inputs_from_drive now read MKB_RO.inf first.
  MKB_RW.inf is a fixed ~128 MiB rewritable region that is mostly zero
  padding; reading it shipped 124 MiB of nothing. MKB_RO is the real,
  correctly-sized MKB (a few MB). Fall back to RW only if RO is absent.
- disable_keydb no longer drops the Volume ID. A caller resolving Unit Keys
  out-of-band needs the VID (on-disc content read during the handshake).
  New resolve_vid_only builds a keys-free AacsState carrying just the VID +
  version metadata, so the disc reports 'encrypted, no keys' (resolved
  out-of-band) instead of discarding the VID.

src/disc/mod.rs

@@ -1173,9 +1173,12 @@ impl Disc {
             .read_file(&mut reader, "/AACS/Unit_Key_RO.inf")
             .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/DUPLICATE/Unit_Key_RO.inf"))
             .map_err(|_| Error::AacsNoKeys)?;
+        // Prefer MKB_RO: it's the real, correctly-sized MKB. MKB_RW is a
+        // fixed ~128 MiB rewritable region that is mostly zero padding — reading
+        // it ships 124 MiB of nothing. Fall back to RW only if RO is absent.
         let mkb = udf_fs
-            .read_file(&mut reader, "/AACS/MKB_RW.inf")
-            .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/MKB_RO.inf"))
+            .read_file(&mut reader, "/AACS/MKB_RO.inf")
+            .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/MKB_RW.inf"))
             .map_err(|_| Error::AacsNoKeys)?;
         Ok((inf, mkb))
     }
@@ -1191,9 +1194,12 @@ impl Disc {
             .read_file(&mut reader, "/AACS/Unit_Key_RO.inf")
             .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/DUPLICATE/Unit_Key_RO.inf"))
             .map_err(|_| Error::AacsNoKeys)?;
+        // Prefer MKB_RO: it's the real, correctly-sized MKB. MKB_RW is a
+        // fixed ~128 MiB rewritable region that is mostly zero padding — reading
+        // it ships 124 MiB of nothing. Fall back to RW only if RO is absent.
         let mkb = udf_fs
-            .read_file(&mut reader, "/AACS/MKB_RW.inf")
-            .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/MKB_RO.inf"))
+            .read_file(&mut reader, "/AACS/MKB_RO.inf")
+            .or_else(|_| udf_fs.read_file(&mut reader, "/AACS/MKB_RW.inf"))
             .map_err(|_| Error::AacsNoKeys)?;
         Ok((inf, mkb))
     }
@@ -1226,6 +1232,15 @@ impl Disc {
                 Ok(state) => (Some(state), None),
                 Err(e) => (None, Some(e)),
             }
+        } else if opts.disable_keydb {
+            // Keydb disabled: keys are resolved out-of-band. Still capture the
+            // VID (read during the handshake) so the out-of-band path has it;
+            // carry no keys (disc reports "encrypted, no keys" until re-scanned
+            // with a resolved Unit Key).
+            match Self::resolve_vid_only(&udf_fs, reader, handshake.as_ref()) {
+                Ok(state) => (Some(state), None),
+                Err(e) => (None, Some(e)),
+            }
         } else {
             match opts.resolve_keydb() {
                 Some(keydb_path) => {