[core] Support block-compressed NSZ and XCZ (#4552)

- [x] I have read and followed the [Contribution Guidelines](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/CONTRIBUTING.md#code-contributions).
- [x] I have read and followed the [AI Policy](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/docs/policies/AI.md).
- [x] I have read and followed the [Coding Guidelines](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/docs/policies/Coding.md) to the best of my ability.

-------------------
- Add NCZBLOCK (nsz -B / .xcz) reader: each read decodes only the covered blocks and re-encrypts CTR sections, no disk output.
- Allow installing solid .nsz to NAND via DecompressNCZForInstall (lazy, incremental decode with frontier, O(n) instead of O(n^2)).
- Accept BKTR updates with thousands of sections (MaxSectionCount = 0x10000).
- Wire .nsz/.xcz into loader, registered cache, scanner, and NAND install (content_manager.h), and reject solid NCZ from the game list.
- Bump the pinned zstd to 33618c8 in cpmfile.json, which includes the upstream AArch64 revert ([33618c89](33618c89e5)) for a ZSTD_decodeSequence branch optimization that could corrupt data on ARM64; without it, solid NCZ decoding on Android fails with "Data corruption detected".

NCZ format and CTR counter semantics follow the reference nsz tool and its
Rust port:
- https://github.com/nicoboss/nsz (Decompressor.py, BlockDecompressorReader.py)
- https://docs.rs/nsz-rs/0.3.0/src/nsz_rs/decompress.rs.html

The last-block edge case (decompressed size is an exact multiple of block
size) is handled as described in https://github.com/nicoboss/nsz/issues/210

Reviewed-on: https://git.eden-emu.dev/eden-emu/eden/pulls/4552
Reviewed-by: CamilleLaVey <camillelavey99@gmail.com>
Reviewed-by: Shinmegumi <shinmegumi@eden-emu.dev>

src/core/file_sys/registered_cache.cpp

@@ -16,6 +16,7 @@
 #include "common/random.h"
 #include "common/string_util.h"
 #include "core/crypto/key_manager.h"
+#include "core/crypto/ncz_decompressor.h"
 #include "core/file_sys/card_image.h"
 #include "core/file_sys/common_funcs.h"
 #include "core/file_sys/content_archive.h"
@@ -158,6 +159,25 @@ static std::shared_ptr<NSP> OpenContainerAsNsp(const VirtualFile& file, Loader::
     return nullptr;
 }
 
+// Checks that every .ncz entry in the container is NCZBLOCK. Solid NCZ has no random access,
+// and the whole point of this build is to reject it at scan time so such files never appear
+// in the game list. Containers without any .ncz (plain NSP/XCI) pass through.
+static bool ContainerIsFullyBlockCompressed(const std::shared_ptr<NSP>& nsp) {
+    if (!nsp) {
+        return false;
+    }
+    for (const auto& entry : nsp->GetFiles()) {
+        const auto name = entry->GetName();
+        if (name.size() < 4 || name.substr(name.size() - 4) != ".ncz") {
+            continue;
+        }
+        if (!Core::Crypto::IsBlockCompressedNCZ(entry)) {
+            return false; // solid NCZ -> reject the whole container
+        }
+    }
+    return true; // no .ncz at all, or all block-compressed
+}
+
 template <typename Callback>
 bool ForEachContainerEntry(const std::shared_ptr<NSP>& nsp, bool only_content,
                            std::optional<u64> base_program_id, Callback&& on_entry) {
@@ -811,7 +831,14 @@ std::vector<ContentProviderEntry> RegisteredCache::ListEntriesFilter(
 }
 
 static std::shared_ptr<NCA> GetNCAFromNSPForID(const NSP& nsp, const NcaID& id) {
-    auto file = nsp.GetFile(fmt::format("{}.nca", Common::HexToString(id, false)));
+    const auto id_string = Common::HexToString(id, false);
+    auto file = nsp.GetFile(fmt::format("{}.nca", id_string));
+    if (file == nullptr) {
+        if (auto ncz_file = nsp.GetFile(fmt::format("{}.ncz", id_string))) {
+            file = Core::Crypto::DecompressNCZForInstall(
+                ncz_file, fmt::format("{}.nca", id_string));
+        }
+    }
     if (file == nullptr) {
         return nullptr;
     }
@@ -1273,6 +1300,12 @@ bool ManualContentProvider::AddEntriesFromContainer(VirtualFile file, bool only_
         return false;
     }
 
+    // Reject solid NCZ (.nsz without -B): only block-compressed NCZ is supported.
+    if (!ContainerIsFullyBlockCompressed(nsp)) {
+        LOG_DEBUG(Service_FS, "Skipping solid-compressed container: {}", file->GetName());
+        return false;
+    }
+
     return ForEachContainerEntry(
         nsp, only_content, base_program_id,
         [this](TitleType title_type, ContentRecordType content_type, u64 title_id,
@@ -1415,8 +1448,9 @@ void ExternalContentProvider::ScanDirectory(const VirtualDir& dir) {
         }
 
         const auto extension = Common::ToLower(filename.substr(dot_pos + 1));
-
-        if (extension == "nsp") {
+        // .xcz is an XCI container, but its updates only work through the NSP/PFS0 path
+        // (DecompressNCZ), not ProcessXCI. So route .xcz here on purpose.
+        if (extension == "nsp" || extension == "nsz" || extension == "xcz") {
             ProcessNSP(file);
         } else if (extension == "xci") {
             ProcessXCI(file);
@@ -1434,6 +1468,12 @@ void ExternalContentProvider::ProcessNSP(const VirtualFile& file) {
         return;
     }
 
+    // Reject solid NCZ (.nsz without -B): Eden only supports block-compressed NCZ.
+    if (!ContainerIsFullyBlockCompressed(nsp)) {
+        LOG_DEBUG(Service_FS, "Skipping solid-compressed container: {}", file->GetName());
+        return;
+    }
+
     LOG_DEBUG(Service_FS, "Processing NSP file: {}", file->GetName());
     AddExternalEntriesFromContainer(nsp, entries, versions, multi_version_entries);
 }

src/core/file_sys/submission_package.cpp

@@ -12,6 +12,7 @@
 #include "common/hex_util.h"
 #include "common/logging.h"
 #include "core/crypto/key_manager.h"
+#include "core/crypto/ncz_decompressor.h"
 #include "core/file_sys/common_funcs.h"
 #include "core/file_sys/content_archive.h"
 #include "core/file_sys/nca_metadata.h"
@@ -246,6 +247,17 @@ void NSP::ReadNCAs(const std::vector<VirtualFile>& files) {
                 const auto id_string = Common::HexToString(rec.nca_id, false);
                 auto next_file = pfs->GetFile(fmt::format("{}.nca", id_string));
 
+                if (next_file == nullptr) {
+                    auto ncz_file = pfs->GetFile(fmt::format("{}.ncz", id_string));
+                    if (ncz_file != nullptr) {
+                        next_file = Core::Crypto::DecompressNCZ(ncz_file, fmt::format("{}.nca", id_string));
+                        if (next_file == nullptr) {
+                            LOG_DEBUG(Service_FS, "Skipping solid or unsupported NCZ content {}.ncz", id_string);
+                            continue;
+                        }
+                    }
+                }
+
                 if (next_file == nullptr) {
                     if (rec.type != ContentRecordType::DeltaFragment) {
                         LOG_WARNING(Service_FS,