Close the MEDIUM mutation gaps across transport, labels and codecs

The remaining triage items after tonight's HIGH fixes: 1,290 lines, almost
all tests. Covers disc/mod.rs's DVD scan path (with real minimal VMG/VTS IFO
fixtures rather than mocks), drive/mod.rs, labels/class_reader.rs and
labels/mod.rs — the two biggest untriaged survivor clusters in the crate —
plus hevc.rs and ps.rs.

One production change, and it is an extraction rather than a behaviour
change: MacScsiTransport::open mapped the shim's negative failure sentinels
to typed errors inline, where nothing could reach it without a real IOKit
FFI call. It is now map_shim_open_error, so the mapping can be pinned. It
matters because collapsing -5 into the DeviceNotFound catch-all turns
"another process holds the drive" into "no such drive", and an operator
chasing the wrong problem is worse than a blunt error.

Gate green on the pinned toolchain including the secrets scanner.

src/mux/ps.rs

@@ -1816,4 +1816,36 @@ mod tests {
         );
         assert_eq!(parsed.data, es);
     }
+
+    /// A length-bounded PES (`pes_packet_len != 0`) must be emitted the
+    /// moment its declared length is EXACTLY satisfied by the buffer
+    /// (`sc + 6 > len`, then `e = sc + 6 + pes_packet_len; e > len`), not
+    /// held back waiting for a byte that will never arrive. Feed nothing
+    /// after the packet and don't flush — if the boundary checks were
+    /// `>=` instead of `>`, an exact fit would incorrectly be treated as
+    /// "not enough data yet" and the packet would never be produced.
+    #[test]
+    fn length_bounded_pes_exact_fit_is_emitted_not_awaited() {
+        let mut demuxer = PsDemuxer::new();
+        let payload = [0x11u8, 0x22, 0x33, 0x44, 0x55];
+        let mut data = vec![0x00, 0x00, 0x01, 0xC0]; // audio stream id
+        let pes_packet_len = (3 + payload.len()) as u16; // flags+header_len byte + payload
+        data.extend_from_slice(&pes_packet_len.to_be_bytes());
+        data.extend_from_slice(&[0x80, 0x00, 0x00]); // no PTS/DTS, header_data_len = 0
+        data.extend_from_slice(&payload);
+        assert_eq!(data.len(), 6 + pes_packet_len as usize, "sanity: exact fit");
+
+        let packets = demuxer.feed(&data);
+        assert_eq!(
+            packets.len(),
+            1,
+            "an exact-fit length-bounded PES must be emitted immediately, \
+             not held awaiting a byte that will never come"
+        );
+        assert_eq!(packets[0].data, payload);
+        assert!(
+            demuxer.buffer.is_empty(),
+            "the exact-fit PES must be fully consumed, leaving nothing buffered"
+        );
+    }
 }