fix(pcapng)!: PCAP-NG round-trip follow-ups (#1382, #1383, #1384, #1401, #1405, #1406)

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — run on the three pcapng.py files; isort clean, no new mypy errors (6 pre-existing)
• make test passes, and a test case covers the change — legs below, not the full suite
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Issue	Fix
#1382	Direction 0b11 and reception 5–7 become an Unassigned member, not ProtocolError. Bits 9–11 are named (checksum_not_ready, checksum_valid, tcp_segmentation_offloaded); reserved is now bits 12–23.
#1383	NRB names split one per terminator, so a\0\0 → ('a', ''). Empty or unterminated name data keeps the record area raw (#1325).
#1384	An SPB holding more than the snaplen keeps the excess, warns, and rebuilds from captured_len.
#1401	#1400's incumbent == meth guard on the four PCAP-NG registrars.
#1405	EPB/PB packet data is bounded by the block; the declared captured_len is kept, 36 → 36.
#1406	Option (1): the binary-field overrun raises, the entry is kept as entry_raw and rebuilt verbatim.

Breaking: EPB_FlagsOption/PACK_FlagsOption gain three required fields and reserved shifts; the journal clamp and the undefined-flags error are gone. Four existing tests pinned old behaviour and are updated.

Six new tests/protocols/misc/test_pcapng_*_unit.py modules; each fails with origin/main's sources written back (44, 13, 3, 12, 8, 5 failures incl. subtests, in table order). Legs: protocols --exclude protocols/internet 1043 OK, foundation 522 OK, tests/integration 90 passed, tests/project 400 passed.

Closes #1382
Closes #1383
Closes #1384
Closes #1401
Closes #1405
Closes #1406

[github-actions]

Coverage: 89.41% (unit tier, Python 3.14, 0514d5c30, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2038	89	634	25	94.76%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2637	98	928	48	94.78%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16462	219	4392	183	98.03%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Cross-review verdict on 0514d5c30: GOOD TO GO (Sonnet reviewed; author Opus).

• Fixtures. I compared all 6 .pcapng fixtures (241 frames) under both the default and dpkt engines. The only difference is the three new EPB_FlagsOption fields, and removing them gives main's output exactly.
• Fuzz. About 14,000 SHB/IDB/EPB/PB/SPB/NRB/ISB/Journal cases. Nothing exact on main regresses, and no new exception escapes. 1,326 mismatches are now exact, and 159 parse errors now round-trip. A full extract() over every malformed block completes.
• fix(pcapng): undefined epb_flags direction or reception values raise, so such a capture cannot round-trip #1382. The Unassigned member follows the const/pcapng registry pattern. Out-of-range values still raise EnumValueError. reserved at bits 12–23 keeps bits 16–23, which carry no defined error flags, so the layout is byte-faithful.
• fix(pcapng): an NRB record whose name list ends in empty names loses them on rebuild #1383. NRBs written by real tools (localhost\0, a\0b\0) parse as before, and every edge case rebuilds exactly.
• Tests. The revert proof fails every new module. tests/project passes 586/0 (the PR body says it was not run), protocols 1043/0, corekit 633/0.

Follow-ups: these malformations behave the same on main and are outside these six issues. I reproduced them at this head and filed them as #1413 (Journal: unterminated binary field, bare key) and #1414 (SPB past original_len, EPB/PB below 32 octets). Non-zero padding zeroing stays under #1223.