feat(kernel): harden GRE protocol 47 admission

[kernalix7]

Summary

Audit the GRE receive parser and wire IPv4 protocol 47 into NetworkStack as a structural admission gate. Malformed GRE remains silently consumed/dropped at the public boundary, with saturating admitted/dropped counters making the verdict observable.

Changes

• enforce RFC 2784 receive-side version, discard-bit, and Reserved0 handling
• parse all C/K/S optional-field layouts with strict aggregate bounds
• validate C-bit checksums over the complete GRE header and payload, including odd lengths
• reuse the shared validator from tunnel decapsulation
• reject invalid IPv4 declared lengths and exclude Ethernet padding from the IP payload
• dispatch protocol 47 without prematurely decapsulating or reinjecting inner payloads
• expose read-only GRE admitted/dropped counters using saturating accounting
• add parser, checksum, IPv4-boundary, dispatch, counter, and mutation-sensitive regressions

Related Issues

None.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace -- -D warnings
• cargo build --workspace
• focused GRE tests: 28 passed
• strict Miri GRE tests: 28 passed
• bash scripts/run-tests.sh: 4,650 passed, 0 skipped
• bash scripts/run-qemu-test.sh: x86_64, aarch64, and riscv64 passed
• mutation proof: bypassing validate_gre_packet makes the corrupt boundary test fail
• five-lane final review: goal, QA, code quality, security, and context all PASS

Checklist

• Public APIs are documented with /// comments
• No new unsafe blocks or external dependencies
• Existing license headers retained; no new files added
• No hardcoded paths, credentials, or personal information
• Documentation impact is limited to API/test comments; no user-facing docs required

Follow-up

IPv4 fragment reassembly is not implemented. A fragmented GRE packet can currently affect admission telemetry, but payloads are not decapsulated or delivered. Fragment rejection or reassembly should be addressed before live tunnel delivery.

Screenshots

Not applicable.