test(net): property-test the headers view, matcher, and builder

[daniel-noland]

Second of five, stacked on #1733.

Property tests for net::headers — the HeadersView unsafe boundary, the
pattern matchers, the builder's Within::conform, and the embedded (ICMP-quoted)
header views. Coverage of the module went from roughly a third to the high
nineties; the lines still uncovered are the unreachable_unchecked arm of each
arity, which must stay uncovered because reaching one is the undefined behaviour
the whole HeadersView invariant exists to prevent.

The recurring finding, across five separate instances, was code that no
generator could reach rather than code that was wrong: embedded_ip was never
set by any generator, the absent-layer arm of every opt_* method was
unconstructible, no shape ever named Vxlan, the first-step-refusal branch was
unreachable at every arity, and conform was only reachable through a builder
no test used. In each case "we have tests for that" was false and the tests
looked fine.

Two things the tests pin rather than fix, both for the owner to decide:

• when/inspect/otherwise on the embedded matchers read only the inner
  accumulator, while done() requires both. A packet whose outer chain fails
  but whose quoted packet matches runs inspect, skips otherwise, and then
  returns None — 4,974 packets in 25,000. Documented behaviour, but
  otherwise is the error hook and stays silent for a whole class of failure.
• All twelve Within<Icmp4|Icmp6> for <subtype> conform bodies are dead.
  Install runs afterwards from build_headers and overwrites whatever they
  wrote, and nothing can be stacked on a subtype, so there is no arrangement in
  which conform gets the last word.

The last commit is new, not extracted: the embedded vacuity guard only asserts
once a run is long enough for a miss to mean something, and its threshold was
set at the case count a default run managed when it was written. Coverage
instrumentation costs about a fifth of the throughput here — measured at 17 hits
in 20,206 cases against 21 in 25,857 — which left the threshold sitting a couple
of hundred cases below what CI actually draws, so a busier runner would drop
under it and the check would disappear silently. Lowered to ten thousand.

Worth recording since #1714 adds --cfg=instrumented for this purpose: these
properties are bound by the generator rather than by a counter loop, so unlike
the fib test that motivated the cfg, no iteration counts need cutting here.

Verified locally: dataplane-net 473/473, fmt --check and
clippy -D warnings clean.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 96.83973% with 28 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
net/src/headers/embedded.rs	91.20%	6 Missing and 2 partials ⚠️
net/src/headers/view.rs	94.21%	4 Missing and 3 partials ⚠️
net/src/headers/embedded_view.rs	96.53%	4 Missing and 2 partials ⚠️
net/src/headers/within.rs	93.22%	3 Missing and 1 partial ⚠️
net/src/headers/mod.rs	98.78%	1 Missing and 1 partial ⚠️
net/src/headers/pat.rs	99.63%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[daniel-noland]

Recreated with a corrected base after the stack was reordered into chapters. GitHub will not re-base a PR that is part of a stack, and these were never out of draft.