refactor(corekit): share one PortEnumField across TCP, UDP and SCTP (#1516)

[JarryShaw]

Please follow the guide below

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• refactor — changes neither behaviour nor performance

---

Description of your pull request and other information

The three PortEnumField classes in schema/transport/{tcp,udp,sctp}.py were AST-identical apart from the TransportProtocol member in post_process. They become one public PortEnumField in corekit/fields/numbers.py, beside EnumField, with a keyword-only proto. Each schema passes its own. It is documented on the numbers page and in the fields class diagram.

• Byte-identical: all 1398 TCP, UDP and SCTP layers in examples/captures/* (1261/103/34) give the same octets and port members before and after. That covers parse→rebuild, from_data(info.to_dict()), and make→parse from members and from bare ports. Digest sha256 010bd641… both times.
• Tests: tests/corekit/test_fields_numbers_port_enum_field_1516_unit.py has 7 tests, and all 7 fail on main. A mutant that ignores proto fails 5 subtests. Updated: the existing callers of the old classes, the field round-trip table, and the composite-proto sweep in tests/const.
• Not re-exported from corekit.fields: doing so forces PortEnumField into corekit/__init__.py's __all__, which refactor(corekit)!: Info.to_dict() returns an OrderedMultiDict; add MultiInfo and OrderedMultiInfo (#1484) #1523 has in flight (test_public_api fails otherwise). SwitchField sets the precedent.
• Selections run, not the whole suite: tests/corekit, tests/protocols/transport, each tests/protocols/test_*roundtrip*, tests/project, tests/test_docstring_contract.py, tests/test_tier_guard.py, plus the touched tests/const and tests/dumpkit modules. All pass.

Refs #1516

[github-actions]

Coverage: 90.10% (unit tier, Python 3.14, c68689e63, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18795	842	2356	756	92.09%
pcapkit/corekit	2186	67	710	34	96.24%
pcapkit/dumpkit	242	2	88	2	98.79%
pcapkit/foundation	2665	98	934	42	95.00%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	17021	229	4598	189	98.04%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	431	4	124	4	98.56%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: GOOD TO GO at c68689e63. Cross-reviewed on Sonnet; the author ran Opus.

• The three old classes are AST-identical once docstrings are stripped. The only difference is the Enum_TransportProtocol.<proto> member.
• Field behaviour is identical. A sweep of post_process over every port 0–65535 and out-of-range values, plus unpack, pack, pre_process and pickling, compared 2,163,609 entries per run with transports in both orders. The only differences are the class's __module__ and the new _proto. 900 TCP/UDP ports and 6,155 TCP/SCTP ports resolve differently, so the sweep is not vacuous. No registry entries are minted.
• Captures are byte-identical. On 1,398 TCP/UDP/SCTP layers, canonical to_dict(), from_data, pack({}) and three make→parse paths give identical output. The 69 json/tree/plist dumps are identical too.
• The lazy AppType import is not a hot-path cost. extract(http.pcap) makes 0 pre_process calls.
• Fail-before and mutation. The new tests give 29 failures. A mutant that ignores proto fails exactly 5 subtests.
• The other changed tests are updated, not weakened.

Non-blocking:

• The lazy import isn't strictly required today: a module-level import still loads cleanly from all nine entry points.
• PortEnumField is not re-exported from pcapkit.corekit.fields. Doing so needs corekit/__init__.py, which refactor(corekit)!: Info.to_dict() returns an OrderedMultiDict; add MultiInfo and OrderedMultiInfo (#1484) #1523 owns; SwitchField sets the same precedent.