fix(net): store the checksum an incremental update computes

[daniel-noland]

First of five, stacked on #1724. Extracts the finished fuzzing campaign from
pr/daniel-noland/icmp-flow-lock, which was never opened as a PR and had
drifted well behind main.

This one is a production bug, on its own so it can be taken without the rest.

Checksum::increment_update_checksum works out the new checksum and hands it
back; it does not store it, despite taking &mut self.
EmbeddedTransport::update_checksum called it and dropped the answer, under a
comment about ignoring errors on a truncated header — but there is no error to
ignore, the return value is the checksum. So no quoted transport header has
ever had its checksum updated.

NAT rewrites the ports of the packet quoted inside an ICMP error and calls this
to keep the checksum in step. Receivers that validate the quoted checksum will
reject the error; that is the path PMTUD depends on. Plenty of stacks do not
validate it, which is likely why nothing has complained.

update_checksum_for_address is new, and folds a change of one of the quoted
packet's addresses in — TCP, UDP and ICMPv6 checksum over a pseudo-header built
from the addresses, so rewriting one leaves the quoted checksum describing an
address that is no longer there. ICMPv4 has no pseudo-header and is left alone.

Verified locally rather than in CI, given the outage: dataplane-net 473/473,
fmt --check and clippy -D warnings clean. Reverting the fix fails exactly
a_v4_address_change_matches_a_fresh_tcp_checksum and its v6/UDP twin.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3d223ecc-c50f-44d0-b3e5-dba18ffead0c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 91.20879% with 8 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
net/src/headers/embedded.rs	91.20%	6 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[daniel-noland]

Its single commit now opens #1734; a one-commit PR with a ten-commit child was a review artifact, not a chapter.