Add GUI parity for -c/-a, mDNS/SSH dissectors, and two new fuzz harnesses

GUI parity: checksum_status()/reassembled_http_status() moved out of
main.cpp into a shared wireframe/packet_diagnostics.hpp so the GUI can
show the same -c/-a diagnostics for the selected packet without
duplicating the Ethernet/IPv4/TCP walk. Visually verified under Xvfb
with the same split-segment scenario used to verify -a on the CLI.

Two new L7 dissectors: mDNS (reuses parse_dns outright - RFC 6762
keeps DNS's wire format, just a different port) and SSH's cleartext
identification banner. Live-verified against this machine's real
sshd and a real DNS-wire-format packet sent to port 5353.

Two new fuzz harnesses (fuzz_checksum, fuzz_tcp_reassembly) covering
code added here that the original nine harnesses never
touched. All 12 run clean across ~90M executions with no crashes.

NAMES.md and PLAN.md updated with this round's decisions and naming
candidates.

1 files changed, 11 insertions, 1 deletions

diff --git a/include/wireframe/summarize.hpp b/include/wireframe/summarize.hpp
index e7e9ae3..840ddf9 100644
--- a/include/wireframe/summarize.hpp
+++ b/include/wireframe/summarize.hpp
@@ -11,6 +11,8 @@
 #include "wireframe/l7/dissector.hpp"
 #include "wireframe/l7/dns.hpp"
 #include "wireframe/l7/http.hpp"
+#include "wireframe/l7/mdns.hpp"
+#include "wireframe/l7/ssh.hpp"
 #include "wireframe/l7/tls.hpp"
 #include "wireframe/net/ethernet.hpp"
 #include "wireframe/net/icmp.hpp"
@@ -57,16 +59,24 @@ inline std::string tcp_flags_to_string(std::uint8_t flags) {
 // DNS alone never did, since it only ever runs over UDP port 53. TLS
 // (also TCP, port 443) covers what HTTP increasingly can't: most web
 // traffic today is encrypted, and SNI is the one piece of a TLS
-// handshake still readable without decrypting anything.
+// handshake still readable without decrypting anything. mDNS reuses
+// DNS's own parser (same wire format, different port/label) at
+// essentially no extra cost. SSH is the first dissector whose *entire*
+// protocol is one cleartext line before everything else encrypts --
+// unlike TLS's SNI, there's nothing further to ever add here.
 inline const net::L7Registry& l7_registry() {
     static const net::DnsDissector dns_dissector;
     static const net::HttpDissector http_dissector;
     static const net::TlsSniDissector tls_dissector;
+    static const net::MdnsDissector mdns_dissector;
+    static const net::SshDissector ssh_dissector;
     static const net::L7Registry registry = [] {
         net::L7Registry r;
         r.add(&dns_dissector);
         r.add(&http_dissector);
         r.add(&tls_dissector);
+        r.add(&mdns_dissector);
+        r.add(&ssh_dissector);
         return r;
     }();
     return registry;