refactor(toolkit): make tcp_segment and its result type public in toolkit.pcap (#1570)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

• Placement: this follows refactor: move shared helper functions into utilities or corekit by use case #1519's test_start_line ruling (refactor(http): move test_start_line and its patterns into the http base module (#1519) #1525). The shared helper becomes public in the module both callers already import, so it stays in toolkit/pcap.py, which toolkit/pcapng.py imports at top level. No new module and no import cycle.
• Names: _tcp_segment → tcp_segment and _TCPSegment → TCPSegment. The type is exposed as the helper's return type, so both are now in pcap.__all__. The bodies are unchanged. Neither is re-exported from pcapkit.toolkit, which pcapkit.all star-imports.
• Callers: pcapng.py imports tcp_segment and uses it at both call sites.
• Docs: toolkit/builtin.rst documents both under PCAP Tools in an "Auxiliary Functions" subsection, the layout 3rdparty.rst uses. block2frame moves into one under PCAP-NG Tools. The Sphinx build gives no warnings from these pages.
• Tests: the new tests/toolkit/test_pcap_tcp_segment_public_1570_unit.py has 6 tests, modelled on tests/interface/test_registry.py. It pins __all__, the shared object, the fields, the helper on PCAP and PCAP-NG frames, and that all four TCP adapters call it. All 6 fail on main. Coverage of pcap.py and pcapng.py is unchanged.

Ran one at a time: tests/toolkit, the TCP reassembly, traceflow and engine-agreement runtime tests, test_public_api.py, test_isort_clean.py, test_docstring_contract.py. All green.

Closes #1570

[JarryShaw]

Verdict: GOOD TO GO at 8d9644175. Cross-reviewed on Sonnet; the author ran Opus. It merges cleanly into current main and pairwise with #1569, #1573, #1575 and #1578.

• No behaviour change. After the rename, pcapng.py is AST-identical to main, and so are tcp_reassembly/tcp_traceflow. tcp_segment/TCPSegment differ only in their docstrings. Reassembly and trace output is byte-identical to main across all 23 sample captures, 13 of which carry TCP.
• No old names left. I checked myself that _tcp_segment and _TCPSegment appear nowhere in pcapkit/, docs/ or examples/. The only mentions are the new test's assertion that they are absent.
• Precedent. Both names sit in pcap.__all__ and aren't re-exported from pcapkit.toolkit. That matches refactor(http): move test_start_line and its patterns into the http base module (#1519) #1525's test_start_line and refactor(interface): make the registry-entry helpers public in pcapkit.interface.registry (#1519) #1568.
• Docs. A narrow Sphinx build gives no new warnings, and nitpicky mode leaves no unresolved target.
• Fail-before. The new test fails on main: 5 tests plus 4 subtests.
• Tests. These all pass: toolkit (142), traceflow (38), reassembly (116), public API, module isolation, isort, docstring contract, doc claims and tier guard.

For your information, non-blocking:

• TCPSegment is a NamedTuple, now public, while the rest of the package's public data types are Info classes. That predates this PR.
• Its rendered signature shows the module-internal aliases Data_IPv4 | Data_IPv6.