Add PCAP evidence, sanitizers, fuzzing, and lab tooling

[masarray]

Scope

Phase 1E hardens process-bus evidence and decoder security.

PCAP equivalence

• Read-only PCAP analyzer for GOOSE, Sampled Values, other Ethernet, and malformed packets.
• Exact byte-for-byte decode/re-encode comparison.
• Canonical PCAP order, payload, and microsecond-normalized timestamp round-trip.
• JSON report and ariec61850_pcap_interop_check CLI.
• Synthetic C#-derived GOOSE/SV PCAP corpus.

Security and fuzzing

• PCAP snaplen, included-length, and original-length checks before allocation.
• Supported PCAP allocation bound of 16 MiB.
• Regression for malicious packet lengths.
• ASan/UBSan CMake option and workflow.
• LLVM libFuzzer targets and seed corpora for BER, GOOSE, Sampled Values, and PCAP.
• Deterministic mutation-smoke suite.

Isolated-lab tooling

• Receive-only Windows/Linux runner scripts.
• Safety checklist and evidence report template.
• No Npcap/raw-socket transmission or IED operation.

Validation

The branch was rebuilt as one clean Phase 1E commit on top of merged main. Both the GCC/Clang/MSVC matrix and Security/Evidence workflow will run again before merge.

Acceptance boundary

Automated synthetic evidence is included. Real IED/vendor-simulator GOOSE and SV captures remain pending until controlled physical-lab evidence is supplied.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.