[Bug] inspect_pcap_capture returns null capture_start/capture_end with Wireshark 4.0–4.2 (capinfos prints "First/Last packet time") #4180

Before submitting

• I searched the open and closed issues and PRs for a related report (capture_start, capinfos, "Earliest packet time", "First packet time"): none found. Open PR refactor(pcap): give TShark selection and version admission one owner #3407 refactors TShark selection and doesn't touch the capinfos parser.
• I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

With the Ubuntu 24.04 Wireshark package (TShark/Capinfos 4.2.2), inspect_pcap_capture always reports:

"capture_start": null, "capture_end": null, "capture_duration_seconds": 0

capinfos itself reports the times for the same file:

Capture duration:    0.000000 seconds
First packet time:   2026-10-15 16:57:16.031899
Last packet time:    2026-10-15 16:57:16.031899

Cause

src/pcap/PcapOutput.ts (lines ~69-70 on main @ 62bf09809, unchanged since 9581e067a "feat(pcap): add bounded capture summaries through CLI and MCP") reads only the newer labels:

captureStart: lines.get("Earliest packet time") ?? null,
captureEnd:   lines.get("Latest packet time") ?? null,

Labels in capinfos.c by Wireshark tag:

docs/pcap-analysis.md says the family supports caller-selected "Wireshark 4.x" tshark and capinfos. Debian 12 ships 4.0 and Ubuntu 24.04 ships 4.2, so on both current LTS distributions the times are silently null rather than reported or marked unsupported.

Reproduction

Any capture works. With the stock Ubuntu 24.04 packages:

apt-get install tshark          # 4.2.2-1.1build3
REA_TSHARK_COMMAND=/usr/bin/tshark REA_CAPINFOS_COMMAND=/usr/bin/capinfos \
  rea inspect-pcap-capture ./capture.pcap --json | jq '.normalized_result | {capture_start, capture_end}'
# {"capture_start": null, "capture_end": null}
capinfos -M ./capture.pcap | grep "packet time"
# First packet time:   …
# Last packet time:    …

Expected behavior

• Accept both label pairs (First/Last and Earliest/Latest), or
• if only 4.4+ is intended, say so in the docs and in inspect_pcap_client, and report the times as unavailable with a limitation naming the label mismatch rather than a bare null.

A regression fixture with 4.2-style capinfos -M output would cover it.

Impact and scope

• Capture time bounds are always missing on Wireshark 4.0/4.2, which is the default on current Debian and Ubuntu LTS. Every other field I checked was correct.
• Deterministic.

REA version

Executed on rea-agents@6.5.0. The parser is unchanged on main @ 62bf09809.

Runtime and platform

rea Docker image (Ubuntu 24.04) plus apt install tshark (4.2.2-1.1build3), on Windows 11 / Docker Desktop.

Target and artifact context

A synthetic 8-packet pcap built with scapy 2.6.1.

Interface

CLI.

Relevant output or evidence

Everything else matched the capture's ground truth (the packets as built):

• endpoints counted once per packet, including inner IP-in-IP addresses and a packet with the same source and destination;
• DNS answers associated with their question (the additional record for another name wasn't);
• TLS SNI;
• the six frame.protocols stacks;
• HTTP userinfo credentials stripped from an absolute-form URI, with http_uri_redaction_count: 1.