[dnstelecom]

This PR adds native VLAN/QinQ handling and opt-in IPv4 fragment processing, strengthens DNS validation, and improves shutdown behavior, resource controls, and pseudonymization.

Changes

• Decode VLAN/QinQ stacks and preserve their identity in DNS matching and IPv4 reassembly. Identical endpoints on different tagged networks no longer share transaction state; PCP and DEI changes do not split a transaction.
• Add --allow-fragments for matching queries with observable first IPv4 response fragments, and --full-fragments for bounded IPv4 reassembly with incomplete-response fallback. Preserve event ordering across batches and reject overlapping, inconsistent, or UDP-length-mismatched fragment sets.
• Add --max-dns-compression-jumps and DPP_MAX_DNS_COMPRESSION_JUMPS: default 32, with 0 disabling the jump limit. Cache validated suffixes within each message while retaining bounds, backward-pointer, overlap, and expanded-name-length checks.
• Reject standard DNS QUERY messages with multiple questions and responses with truncated declared answer or authority records.
• Make Unix stdin reads interruptible during graceful shutdown, retain packets already accepted into a partial batch, and wake the memory monitor promptly. Reject stdin PCAPNG blocks larger than 16 MiB before reading their bodies.
• Replace collision-prone IPv4 pseudonymization with a keyed permutation, support salted v2 key files, and prevent output paths from overwriting anonymization keys.
• Make --threads and DPP_THREADS enforce a positive CPU execution-budget ceiling.
• Reduce matcher-key size, reuse Parquet column buffers, and restore inlining in the DNS resource-record scanner.
• Correct high-QPS scheduling in the synthetic PCAP generator and strengthen catalog, retry-profile, DNS-name, and timestamp validation.
• Update dependencies and align manifests, toolchain, CI, and documentation with Rust 1.98.1.

Compatibility and operational notes

• IPv4 pseudonyms change even when reusing the same key. Exports from earlier versions cannot be joined with new exports by pseudonymized IPv4 source_ip. Legacy key files remain supported; IPv6 pseudonyms remain unchanged when using the same legacy key.
• --threads and DPP_THREADS were previously compatibility no-ops and now affect execution.
• Fragment handling remains disabled by default. Full reassembly also enables first-response-fragment fallback; IPv6 fragment reassembly remains unsupported.
• CSV and Parquet columns are unchanged. With fragment handling enabled, a populated response_timestamp and empty response_code indicate an observed response prefix whose complete response code is unavailable.
• Full reassembly adds bounded buffering. Smaller inline DNS-name storage reduces matcher-key size but causes longer names to use heap storage.