feat(trace-topology): PCAPNG FrameSource (v0.10.x B-2)

Implement the first real runtime-artefact parser on top of the v0.10.0
trace-topology foundation. `PcapngFrameSource` decodes pcapng captures
from tcpdump/tshark/Wireshark into typed `CapturedFrame` records
carrying mac_src, mac_dst, optional 802.1Q VLAN-ID and PCP, and a
nanosecond timestamp resolved against the per-IDB ts_resol option.

- Adds `pcap-parser = "0.16"` (Pierre Chifflier's crate) as the
  PCAPNG decoder; we own only the L2-header decode + ts conversion
  on top of its block iterator.
- `IngestError` grows concrete kinds (`Io`, `Truncated`,
  `MalformedPcapng`, `UnsupportedLinkType`); `Unimplemented` stays
  for the LLDP/Qcc/gPTP placeholders that ship in sibling commits.
- 5 unit tests (hand-built pcapng byte buffers): untagged round-trip,
  802.1Q VLAN-ID + PCP extraction, truncated-frame error,
  unsupported-link-type error at open(), and µs vs ns ts_resol
  handling.

Per `docs/designs/v0.10.0-trace-topology.md` §"Implementation phasing"
PCAPNG entry. Maps REQ-TRACE-TOPOLOGY-003 / TEST-TRACE-TOPOLOGY-PCAPNG.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

Cargo.lock

@@ -1833,4 +1833,20 @@ artifacts:
     status: planned
     tags: [trace-topology, track-g, v0100, crate]
 
+  - id: REQ-TRACE-TOPOLOGY-003
+    type: requirement
+    title: PCAPNG FrameSource for L2 frame ingest
+    description: >
+      System shall provide a PCAPNG-backed FrameSource implementation
+      in spar-trace-topology that, given a `.pcapng` file recorded
+      with tcpdump / tshark / Wireshark from a TAP/SPAN port, yields
+      a stream of CapturedFrame records carrying mac_src, mac_dst,
+      optional 802.1Q VLAN-ID and PCP, and a Unix-epoch ns timestamp
+      derived from the per-IDB ts_resol option. Built atop the
+      `pcap-parser` crate. Errors carry concrete kinds (Truncated,
+      UnsupportedLinkType, MalformedPcapng, Io). Per the v0.10.0
+      trace-topology design's §"Implementation phasing" PCAPNG entry.
+    status: implemented
+    tags: [trace-topology, ingest, pcapng, v0100]
+
   # Research findings tracked separately in research/findings.yaml

artifacts/requirements.yaml

@@ -2388,3 +2388,23 @@ artifacts:
         target: REQ-TRACE-TOPOLOGY-001
       - type: satisfies
         target: REQ-TRACE-TOPOLOGY-002
+
+  - id: TEST-TRACE-TOPOLOGY-PCAPNG
+    type: feature
+    title: PcapngFrameSource yields correct typed CapturedFrames
+    description: >
+      Tests in crates/spar-trace-topology/src/ingest.rs cover an
+      untagged Ethernet frame roundtrip, an 802.1Q-tagged frame with
+      VLAN-ID and PCP extraction, a truncated frame producing
+      IngestError::Truncated, an unsupported link type producing
+      IngestError::UnsupportedLinkType, and per-IDB ts_resol
+      handling for both µs and ns resolutions.
+    fields:
+      method: automated-test
+      steps:
+        - run: cargo test -p spar-trace-topology --lib -- ingest::tests
+    status: passing
+    tags: [trace-topology, ingest, pcapng, v0100]
+    links:
+      - type: satisfies
+        target: REQ-TRACE-TOPOLOGY-003

artifacts/verification.yaml

@@ -10,6 +10,7 @@ description = "Runtime/declared topology reconciliation for spar (PCAPNG + LLDP
 spar-hir-def.workspace = true
 spar-base-db.workspace = true
 spar-syntax.workspace = true
+pcap-parser = "0.16"
 
 [dev-dependencies]
 tempfile = "3"