docs(repo): second whole-repo pass over repo-level files (#1103)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Summary

#1103 second whole-repo pass, repo slice.

Accuracy -- claims that no longer matched the tree:

• Six crawlers import bs4 at module scope, not seven (pyproject x2,
  cron-vendor.yml); cron-vendor installs .[all,vendor], not .[all].
• benchmark: a default run spawns 3,000 tshark processes per environment,
  not six thousand (README, benchmark.py).
• options.py: IPv4 and HIP have registries; make_samples.py: in.pcap and
  dhcp.pcapng are tracked; the PyYAML note no longer lists four of eleven.
• Re-measured: ci-timing calls (690) and workflow list, bump_version's
  version-commit counts, verdict_covers_checkout's bot commits, and
  MANIFEST.in's sdist note (no stale entry count or "four lines").
• Stale line references: raw.py, arp.py, engines/pcapng.py, pyproject.toml.

Citations: PR #434 and PR #853 cited as their issues, #429 and #851.

Timed context: about 20 "now", "since #NNN", "no longer", "as before",
"until #1674" and "lately" phrases across the workflows, util/ and examples/.

Comments and docstrings only: every changed .py keeps an identical AST with
string expressions blanked; YAML and TOML load identically, except comment-only
lines in one cron-vendor.yml run: block. tests/project passes.

Refs #1103

[JarryShaw]

Verdict: GOOD TO GO at 7f357aa01. A Sonnet cross-review (author: Opus) found no blocking findings. Scope stays inside the slice, the AST guard is identical against main, and every directive was checked against the release tags. The merged build of all nine second-pass heads has 18 warnings, the same as main. tests/project: 950 passed, 1 skipped, 3 warnings, 3670 subtests passed.