Add privilege dropping, AF_PACKET demo, ICMP, checksum validation, --help, and TCP reassembly

Rounds out the build order in PLAN.md with six incremental additions:
drop root privileges immediately after opening the capture handle;
a standalone AF_PACKET/mmap ring-buffer demo (kept separate from
CaptureSession, see its header comment for why); ICMPv4/ICMPv6 type
and code decoding; opt-in IPv4/TCP/UDP checksum validation (-c);
CLI --help; and opt-in, in-order-only TCP stream reassembly (-a) so
HTTP requests/responses split across segments can be seen whole.
Each addition is unit-tested and, where it touches live traffic
behavior, verified against real captured packets - see PLAN.md's
Decisions section for the verification notes on each.

1 files changed, 11 insertions, 0 deletions

diff --git a/include/wireframe/capture_session.hpp b/include/wireframe/capture_session.hpp
index 50764a8..2e3b05a 100644
--- a/include/wireframe/capture_session.hpp
+++ b/include/wireframe/capture_session.hpp
@@ -14,6 +14,7 @@
 #include "wireframe/filter.hpp"
 #include "wireframe/pcapng/reader.hpp"
 #include "wireframe/pcapng/writer.hpp"
+#include "wireframe/privileges.hpp"
 
 // Device-open -> datalink-validate -> filter/pcapng-setup -> signal-hook
 // pipeline, shared by every frontend (CLI, TUI, GUI). Centralized so a
@@ -99,6 +100,16 @@ public:
             return std::string("pcap_open_live failed: ") + errbuf;
         }
 
+        // Everything CAP_NET_RAW/root was needed for is done: the
+        // handle is open. Drop immediately, before the datalink check
+        // or -w's file is even created - the latter is also why this
+        // runs this early rather than at the very end of open(), since
+        // it means a -w output file gets created as the real user, not
+        // root, and doesn't need a manual chown to read back afterward.
+        if (auto err = drop_privileges_if_root()) {
+            return "failed to drop root privileges after opening the capture handle: " + *err;
+        }
+
         datalink_ = pcap_datalink(handle_);
         if (!is_supported_datalink(datalink_)) {
             return std::string("unsupported datalink type on ") + device_ + ": " +