docs(conventions): registry-protocol.rst omits case folds outside get, the str-registry validator shapes and a tier method #2556

From the 2026-11-01 conventions audit, re-verified on 73add05a3. Drift between registry-protocol.rst and the code, plus one fold whose RFC or IANA basis "RFC-Directed Case Sensitivity" requires and nobody cites.

• The page records one fold outside any get (esp._resolve). Others: TCP.read and TCP.make do Enum_Flags.get(key.upper()) (in pcapkit/protocols/transport/tcp.py); TLSKeyLog.post_process and WireGuardKeyLog.post_process in pcapkit/protocols/schema/misc/pcapng.py upper-case labels for TLSKeyLabel and WireGuardKeyLabel, whose rows read "case-sensitive, conforms"; register_apptype's transport coercion in pcapkit/foundation/registry/protocols.py lower-cases into TransportProtocol.__members__.
• The TransportProtocol row grounds the fold on RFC 6335 §8.1.1, but TransportProtocol.get's docstring cites only design: should the non-registry helper enums share a lookup interface, or be made strictly immutable? #877, fix(corekit,utilities): raise pcapkit exceptions from EnumLookup.get, following stdlib Enum's shape #923 and reg: drop TransportProtocol's IntFlag base once nothing builds a composite #808; FEATCode.get and Command.get cite their RFCs.
• The two-tier text says _validate_value checks str "for the string-valued registries". OptionType and AppType are str-valued and check an int range (0..0xFFFF, 0..65535) to match their _missing_.
• The tier table omits EnumRegistry._make_reducible, and reads as the full list.

Fix: record each fold with its RFC or IANA basis, or remove it; cite RFC 6335 in the TransportProtocol.get docstring (template pcapkit/vendor/reg/apptype/apptype.py); reword the validator sentence; complete the table.
Blocked: #2521 edits registry-protocol.rst; unblocks when it merges (gh pr view 2521 --json state -q .state prints MERGED).