Add privilege dropping, AF_PACKET demo, ICMP, checksum validation, --help, and TCP reassembly

Rounds out the build order in PLAN.md with six incremental additions:
drop root privileges immediately after opening the capture handle;
a standalone AF_PACKET/mmap ring-buffer demo (kept separate from
CaptureSession, see its header comment for why); ICMPv4/ICMPv6 type
and code decoding; opt-in IPv4/TCP/UDP checksum validation (-c);
CLI --help; and opt-in, in-order-only TCP stream reassembly (-a) so
HTTP requests/responses split across segments can be seen whole.
Each addition is unit-tested and, where it touches live traffic
behavior, verified against real captured packets - see PLAN.md's
Decisions section for the verification notes on each.

1 files changed, 18 insertions, 0 deletions

diff --git a/tests/test_privileges.cpp b/tests/test_privileges.cpp
new file mode 100644
index 0000000..287d654
--- /dev/null
+++ b/tests/test_privileges.cpp
@@ -0,0 +1,18 @@
+#include <doctest/doctest.h>
+#include <unistd.h>
+
+#include "wireframe/privileges.hpp"
+
+// The actual drop sequence (setuid/setgid) can only be meaningfully
+// exercised by literally running as root, which a unit test shouldn't
+// do - permanently dropping the test runner's own privileges mid-suite
+// would be a real, surprising side effect, not a safe thing to assert
+// on. That path is verified live instead (running the real binary via
+// sudo and checking the dropped-to UID actually took effect - see
+// PLAN.md). This only covers the no-op path any non-root test run
+// takes, which is still worth locking in: it must never attempt to
+// touch privileges it doesn't have.
+TEST_CASE("drop_privileges_if_root is a no-op when not running as root") {
+    if (geteuid() == 0) return;  // this test only makes sense unprivileged
+    CHECK_FALSE(wireframe::drop_privileges_if_root().has_value());
+}