docs(protocols): fourth whole-repo pass over link and transport protocols (#1103)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

The fourth whole-repo prose pass of #1103, over the link and transport protocols. It changes prose only: every changed .py file's AST is unchanged once string expressions are blanked, except where a docstring is added or vendor template text is edited together with its generated const file.

Rendering:

• Drop the inline DefaultDict[...]: type prefix from the registry
  attribute comments in link, loopback, TCP, UDP and SCTP; it rendered
  a second, unlinked Type field naming private aliases and a key type
  that disagreed with the signature.

Accuracy:

• L2TP: cite RFC 3931 section 4.1.1.1 for the session-header quote and
  section 4.7.2 for port 1701 being shared with L2TPv2.
• L2TP: HTTP._guess_version identifies the version first and
  trial-parses only as a last resort, as the docs page already said.

Wording:

• "c.f." becomes "see"; "implements extractor" gains its article.
• UDP length field: "header included"; a missing full stop in the TCP
  schema.

Refs #1103

[JarryShaw]

GOOD TO GO at 639b791b4. A Sonnet cross-review checked the RFC 3931 §4.1.1.1 and §4.7.2 citations against the RFC text and the _guess_version wording against the code. It confirmed that every dropped DefaultDict[...]: prefix keeps a # type: comment, and the AST guard shows all changed .py identical. tests/project passes.

[github-actions]

Coverage: 90.07% (unit tier, Python 3.15, 639b791b4, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	2	20	2	96.77%
pcapkit/const	19595	881	2618	867	92.11%
pcapkit/corekit	2504	70	792	36	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2916	164	1016	34	93.59%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17411	224	4580	189	98.10%
pcapkit/toolkit	872	177	298	8	77.18%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	2341	1018	156	43.64%

Per-file detail: the coverage-html artifact of this run.