feat(utilities)!: one config module for the tunable limits (#1726)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Refs #1726. This PR covers rulings 1–6. Ruling 7, one home per duplicated RFC constant, follows in #1739. It also closes #1708, by fixing that issue's last three agreement lines and dropping its guard's PENDING allowlist.

• New pcapkit/utilities/config.py: every tunable is read once from a PCAPKIT_* variable. That covers the frame-layer and extension-header limits, the IPv6-TCP warned cache, the dumpkit fallback, the chardet cache, the read chunk, the three zero-pad guards, and the vendor retry and CI settings. The proxies are read per call, as before. config imports only utilities.warnings.
• Readers look up config.<NAME> at call time, so one patch reaches every engine.
• Bad or risky values: a bad value warns with ConfigWarning, naming the variable, the value and the importing module, then falls back to the default. -1 lifts a limit; that, or a value above the default, warns of its own risk. Bad DEVMODE/VERBOSE/SPHINX values now warn too.
• Breaking: the old homes are removed with no re-export. Each carries a versionremoved:: 1.5.0, and the docs extra now needs Sphinx>=7.3.
• Docs: docs/source/pcapkit/utilities/config.rst gives every variable's default, range and risk.
• Tests: a literal declaration table covers all 13 variables, with a patched case and a -1 case per reader. Across five Sonnet rounds, every mutant is killed except one proven equivalent.

Closes #1708

[JarryShaw]

Verdict: GOOD TO GO at d74af19ad. A Sonnet cross-review checked it over five rounds (author: Opus). Rounds 1–3 each returned NEEDS CHANGES, all fixed in later rounds.

• Rulings:
  • config imports only utilities.warnings and passes the refactor(corekit)!: move utilities.decorators into corekit, and state the corekit/utilities rule (#1712, option A) #1735 boundary guard;
  • no re-export, and every old home is gone;
  • proxies are read per call, and scapy's _READ_CHUNK is left as it was;
  • each limit warns of its own risk, as ruled.
• Mutation testing:
  • every reader, -1 branch, budget edge, env-var name, default, minimum and risk phrase has a killing test;
  • of 107 + 33 + 3 mutants, only one survives, and it is proven equivalent: no value config accepts behaves differently;
  • stale import-time copies, the bug this issue is about, are killed in every reader.
• Suites: tests/protocols/internet 500 passed, tests/utilities 144, tests/vendor 129, tests/dumpkit 73. Sphinx has 63 warnings on both trees.
• My own re-run in the PR's tree: test_config_unit, test_logging, isort, the 1735 boundary, the 1708 guard, documentation_claims, public_api and all_exports all pass.

[github-actions]

Coverage: 89.69% (unit tier, Python 3.15, d74af19ad, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18860	954	2368	868	91.06%
pcapkit/corekit	2457	69	780	35	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2906	164	1016	34	93.57%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17174	225	4588	190	98.07%
pcapkit/toolkit	864	182	298	9	76.33%
pcapkit/utilities	518	2	158	4	99.11%
pcapkit/vendor	4415	2293	1010	160	44.57%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

The red here is GraalPy alone (#1740). Its runner was lost (The runner has received a shutdown signal), so Required checks passed failed. Every other leg passed, and the KTLO legs fail 0 tests, the same as main. This branch predates #1742, so its Unit Tests run still waits on GraalPy. I have re-run the failed jobs. Once #1742 merges, bringing this branch up to date takes GraalPy out of the required path. The verdict above stands.