fix(pcap): _make_magic ignores nanosecond with explicit endian flags; _read_protos ignores size

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style — ran pylint (W,E) and mypy on header.py directly: no messages on changed lines; make targets not run
• make test passes, and a test case covers the change — only the modules listed below
• Added a changelog entry — N/A, added centrally after the wave

What is the purpose of your pull request?

• fix — corrects a defect

---

Description

Closes #1096. _make_magic's endian-flag branch now looks up _MAGIC_NUM[(endian, nanosecond)]. Header._read_protos now reads size bytes, like Link/Internet. It is kept rather than removed because it overrides the ProtocolBase._read_protos hook and an existing test calls it.

_make_magic(lil, big, nsec)	before	after
(T, F, F)	4d3cb2a1	d4c3b2a1
(F, T, T)	a1b2c3d4	a1b23c4d

_read_protos(1/2) consumed 4 bytes before the fix and consumes 1/2 after it. test_header_frame_unit pinned the old (T, F, F) magic, so that assertion is corrected.

Tests: the new tests/protocols/misc/pcap/test_header_magic_protos_unit.py fails without the fix (6 subtests, 3 passed) and passes with it (3 passed, 11 subtests). test_header_frame_unit passes 6 of 6, dumpkit/test_common_unit 14, test_option_roundtrip_unit 6, and tests/project 379 passed, 1 skipped.

[JarryShaw]

Cross-review verdict on ea5e5df59: GOOD TO GO (ran on Sonnet; author Opus)

• Correction to the issue's table: on main, the flag branch ignored nanosecond. Little-endian always produced the nanosecond magic and big-endian the microsecond one.
• Magic numbers: on this PR all four flag combinations match libpcap: d4c3b2a1, 4d3cb2a1, a1b2c3d4 and a1b23c4d. The byteorder= path agrees with them.
• _read_protos(size): it now reads size bytes, matching the ProtocolBase hook and the Link/Internet versions. Its only callers are tests.
• Tests: with header.py reverted, 6 subtests fail. The edited expectation at test_header_frame_unit.py:145 is right.
• Separate, pre-existing defect: Header(...).pack()[:4] is d4c3b2a1 for every flag combination, on main as well as here. It will be filed separately.

[github-actions]

Coverage: 88.74% (unit tier, Python 3.14, ea5e5df59, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1035	2342	846	90.23%
pcapkit/corekit	1874	91	578	22	94.33%
pcapkit/dumpkit	136	0	40	0	100.00%
pcapkit/foundation	2422	143	842	34	92.62%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15653	187	3942	162	98.19%
pcapkit/toolkit	487	71	144	3	84.15%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.