fix(toolkit): scapy reads link types the default engine leaves raw, and IPv6 at the wrong BSD loopback families #1650

With engine='scapy', the first layer of a frame is whatever scapy dissects for the capture's link type, and nothing checks whether the default engine dissects that layer too. _tcp_carrier (pcapkit/toolkit/scapy.py:429), _first_ipv4 (:365) and ipv6_reassembly (:608) take whatever IP layers they find.

The default engine dissects only NULL, ETHERNET, LOOP, IPV4, IPV6 and RAW (pcapkit/protocols/misc/pcap/frame.py:101-105, RAW at :658) and keeps every other link type Raw. So scapy hands TCP and IP fragments to reassembly and tracing from frames the default engine leaves undissected. In NULL and LOOP frames, the two engines also disagree on which address families mean IPv6.

Repro on main (b375656e1), Linux, dpkt 1.9.8. Python 3.14.8 with scapy 2.7.0 and Python 3.11.15 with scapy 2.8.0 give the same cells.

Each frame is a link header followed by an IPv4 or IPv6 packet. NULL is little-endian, LOOP big-endian. Each cell has four parts, separated by ·:

1. TCP reassembly/trace inputs for IPv4 TCP
2. the same for IPv6 TCP
3. IPv4,IPv6 reassembly inputs for two IPv4 fragments
4. the same for two IPv6 fragments

The default engine's Loopback maps family 2 to IPv4, and 24, 28 and 30 to IPv6 (pcapkit/protocols/link/loopback.py:130-132, #1574). Scapy binds Loopback to IPv6 at socket.AF_INET6 (scapy/layers/inet6.py), which is 10 on this host; it uses 24 only on Windows. It binds IPv4 at socket.AF_INET and, bottom-up, at family 0 (scapy/layers/inet.py). So the NULL and LOOP rows depend on the host that runs pcapkit.

Expected: scapy reads no TCP, IPv4 or IPv6 in a frame whose link type the default engine leaves raw. In NULL and LOOP frames, on every host, it reads IPv4 only at family 2 and IPv6 only at 24, 28 and 30. dpkt already matches. #1636 covers encapsulations inside IP and Ethernet (GRE, VXLAN, PPPoE); this applies the same rule at the first layer. The #1636 fix (#1635/#1636 PR, being raised) leaves this open.