feat(trace-topology): PCAPNG FrameSource (v0.10.x B-2) (#210)

* chore(vet): add exemptions for pcap-parser deps

cargo-vet flagged pcap-parser 0.16.0 and its two transitive deps
(circular 0.3.0, rusticata-macros 4.1.0) as missing safe-to-deploy
audits. Add exemptions in the established pattern; first-party
audits can land later once the maintenance burden is small.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(trace-topology): PCAPNG FrameSource (v0.10.x B-2)

Adds a PCAPNG-backed FrameSource on top of the trace-topology
foundation. Built on Pierre Chifflier's pcap-parser crate; yields
typed CapturedFrame records carrying L2 identity (mac_src, mac_dst,
optional 802.1Q VLAN-ID and PCP) plus a Unix-epoch nanosecond
timestamp resolved via the per-IDB ts_resol option.

Errors carry concrete kinds (Truncated, MalformedPcapng,
UnsupportedLinkType, Io). LINKTYPE_ETHERNET (1) is the only accepted
link type; other captures fail fast at open() time.

Tests: 5 new — untagged frame roundtrip, 802.1Q tagged with VLAN+PCP,
truncated frame error, unsupported link type error, ns-resolution
timestamp. All 6 LLDP tests from B-3 continue to pass alongside.

Closes the v0.10.x B-2 milestone (B-3 LLDP merged as #208).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: re-trigger CI after self-hosted runner disk-full flakes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

Cargo.lock

@@ -1863,4 +1863,20 @@ artifacts:
     status: implemented
     tags: [trace-topology, ingest, lldp, v0100]
 
+  - id: REQ-TRACE-TOPOLOGY-003
+    type: requirement
+    title: PCAPNG FrameSource for L2 frame ingest
+    description: >
+      System shall provide a PCAPNG-backed FrameSource implementation
+      in spar-trace-topology that, given a `.pcapng` file recorded
+      with tcpdump / tshark / Wireshark from a TAP/SPAN port, yields
+      a stream of CapturedFrame records carrying mac_src, mac_dst,
+      optional 802.1Q VLAN-ID and PCP, and a Unix-epoch ns timestamp
+      derived from the per-IDB ts_resol option. Built atop the
+      `pcap-parser` crate. Errors carry concrete kinds (Truncated,
+      UnsupportedLinkType, MalformedPcapng, Io). Per the v0.10.0
+      trace-topology design's §"Implementation phasing" PCAPNG entry.
+    status: implemented
+    tags: [trace-topology, ingest, pcapng, v0100]
+
   # Research findings tracked separately in research/findings.yaml

artifacts/requirements.yaml

@@ -2429,3 +2429,23 @@ artifacts:
     links:
       - type: satisfies
         target: REQ-TRACE-TOPOLOGY-004
+
+  - id: TEST-TRACE-TOPOLOGY-PCAPNG
+    type: feature
+    title: PcapngFrameSource yields correct typed CapturedFrames
+    description: >
+      Tests in crates/spar-trace-topology/src/ingest.rs cover an
+      untagged Ethernet frame roundtrip, an 802.1Q-tagged frame with
+      VLAN-ID and PCP extraction, a truncated frame producing
+      IngestError::Truncated, an unsupported link type producing
+      IngestError::UnsupportedLinkType, and per-IDB ts_resol
+      handling for both µs and ns resolutions.
+    fields:
+      method: automated-test
+      steps:
+        - run: cargo test -p spar-trace-topology --lib -- ingest::tests
+    status: passing
+    tags: [trace-topology, ingest, pcapng, v0100]
+    links:
+      - type: satisfies
+        target: REQ-TRACE-TOPOLOGY-003

artifacts/verification.yaml

@@ -12,6 +12,7 @@ spar-base-db.workspace = true
 spar-syntax.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+pcap-parser = "0.16"
 
 [dev-dependencies]
 tempfile = "3"