P4A: field analysis core, PCAPNG replay, and support bundles

[masarray]

Purpose

Add the first real-world field-usage layer on top of the merged reusable SV core. This draft is paired with the ArSubsv Field MVP PR and remains unmerged for field acceptance testing.

Implemented

• unified offline reader for classic PCAP and PCAPNG Enhanced Packet Blocks
• Ethernet link-type validation and PCAPNG timestamp-resolution handling
• five independent field-health axes: CAPTURE, PROTOCOL, STREAM, CONFIGURATION, and MEASUREMENT
• operational health separated from configuration/measurement review state
• robust signal-state analysis using median, MAD, RMS, fundamental estimate, residual RMS, and SNR
• signal states: Unresolved, Quiet, NoiseDominated, and Active
• no forced-zero or destructive noise suppression
• optional ASDU-field presence reporting; absent datSet, refrTm, smpRate, or smpMod is evidence, not parse failure
• scored SCL binding that does not require optional datSet on wire
• missing captured VLAN tag can remain indeterminate when APPID and destination MAC match, because NIC/driver VLAN stripping is possible
• confRev mismatch remains configuration evidence and does not reject an otherwise strong stream binding
• known-injection comparison contract with REVIEW when no tolerance is supplied
• reproducible ZIP support-bundle writer with manifest, SHA-256 checksums, privacy mode, and safe path validation

Ahmed acceptance behavior represented in deterministic tests

• healthy operational stream remains GOOD while confRev mismatch is CONFIGURATION warning
• noise-dominated zero-input data becomes QUIET / NOISE FLOOR presentation evidence
• APPID 0x4001, destination 01:0C:CD:04:00:00, svID, 64-byte payload, and nofASDU=1 can produce strong SCL binding even when datSet is absent on wire
• expected confRev=100 versus observed confRev=200 remains explicit conflict evidence

Generic boundary

No manufacturer identity is used by parsing, binding, signal classification, scaling, or health logic. Captures from any manufacturer are interoperability fixtures only.

Branch state

The branch was rebuilt directly on merged main, so this PR contains only P4 field-core changes rather than the already-merged engine-unification history.

Validation

ARIEC61850 .NET CI run 240 passed on the rebased P4 head:

• source hygiene, provenance, wording, and licensing checks
• complete restore and warnings-clean build
• deterministic field-core and existing engine tests
• uploaded test diagnostics

The companion ArSubsv PR pins functional engine commit bcecea84b50c628ddce699f1ddafa966aa3255f8; the current PR head adds documentation only after that functional commit.

Pending before merge

• actual Ahmed PCAPNG + CID local replay
• Publisher → capture → ArSubsv end-to-end validation
• known-injection result using a real injected value
• authorized isolated live MU validation

This PR remains draft and does not claim calibrated measurement or formal IEC 61850 conformance.