docs: prefer Protocol over ProtocolBase in cross-references, per the owner's #1103 ruling - #2420

The owner refined the #1103 ruling: a `ProtocolBase.<member>` reference should
read `Protocol.<member>` in the rendered docs, for one consistent public
vocabulary, while the link still targets the `ProtocolBase` attribute. That is
the split-display-target form, `:meth:`Protocol.X <...protocol.ProtocolBase.X>``,
applied across everything Sphinx renders.

* 46 reference sites in `pcapkit/` and `docs/source/` now display
  `Protocol.<member>`. 37 keep their `ProtocolBase` target, which is the
  requested form; the other 9 already targeted `Protocol` -- #2420 moved those
  targets but left the display text reading `ProtocolBase` -- and are now
  display-consistent too.
* Three short-form references in `protocol.py` gained an explicit
  fully-qualified target, so the display text could change without repointing
  the link: `:meth:`ProtocolBase._parse_next_layer`` is now
  `:meth:`Protocol._parse_next_layer <...ProtocolBase._parse_next_layer>``.
* `__init_subclass__` keeps displaying `ProtocolBase` (6 sites). `Protocol`
  defines its own override, so displaying `Protocol` there would name a
  different method than the link resolves to.
* Two further sites keep `ProtocolBase` because the adjacent prose would
  otherwise contradict itself: `schema.py`'s comment reads "``ProtocolBase``,
  not ``Protocol``" two lines above its reference, and
  `protocol-layer-placement.rst` asserts `OSPF.__proto__` *is* that attribute
  inside a paragraph analysing MRO set-difference.
* The `Raises:` clause of `register` is unchanged. It names the class the
  guard's `issubclass` actually tests, not a member whose documentation is
  being pointed at, and `tests/protocols/test_register_class_guard_unit.py`
  asserts that wording (#2316/#1016).
* `tests/` and `examples/` are untouched (28 sites). Their docstrings are not
  part of the Sphinx render, so the display rationale does not reach them.

No link was repointed: a guard canonicalises every role target before and
after and reports them identical, bar the three short-form expansions, which
resolve to the same object. An AST-structure guard (`ast.dump` with docstrings
stripped) confirms all 26 touched `.py` files are prose-only.

Applying the #1103 ruling to the member references #2420 left behind: a
`ProtocolBase.<member>` cross-reference now reads `Protocol.<member>`, for one
consistent public vocabulary, and links there too.

Both halves move, because on the rendered page that is where the documentation
is. `protocol.rst` documents the members with nested
`autoproperty`/`automethod` directives under `.. autoclass:: ...Protocol`, so
`Protocol.<member>` carries the signature and the docstring; the `ProtocolBase`
block is `:no-members:` plus grouped `:no-index-entry:` stubs whose body only
links back to the `Protocol.*` entries, and the general index lists `Protocol.*`
alone. Measured on the pinned docs toolchain (`Sphinx==9.2.0`).

* 46 sites in `pcapkit/` and `docs/source/`. 37 move display *and* target to
  `Protocol.<member>`; the other 9 already targeted `Protocol` and only needed
  the display text. The explicit target is the fully-qualified spelling the
  house style asks for -- the form 124 existing references already use.
* `from_data` is consistent again: `internet.py` and `application.py` pointed
  at `ProtocolBase.from_data` where `link.py` and `transport.py` pointed at
  `Protocol.from_data` for the same kind of reference. All four now read alike.
* `__init_subclass__` keeps `ProtocolBase` (6 sites), since `Protocol`
  overrides it and naming `Protocol` would name a different method. So do
  `schema.py` and `protocol-layer-placement.rst`, whose adjacent prose would
  otherwise contradict itself, and `register`'s `Raises:` clause, which names
  the class the guard's `issubclass` tests (#2316/#1016).
* `changelog/1.5.0.rst` keeps its five `ProtocolBase.<member>` references.
  Each names the class a *built-in* protocol inherits the member from -- the
  built-ins derive from `ProtocolBase`, not `Protocol` -- and `CHANGELOG.md` is
  generated from that file by `util/changelog_md.py`, where a role flattens to
  a code span with no link, so moving them would rewrite release-note prose
  rather than an href.
* `tests/` and `examples/` are untouched (28 sites): their docstrings are not
  part of the Sphinx render.

Hrefs only. A role-canonicalisation guard reports no role and no display-text
change beyond the above, and an AST-structure guard (`ast.dump` with docstrings
stripped) is identical for every touched `.py` file.

 display rule (#2422)

Applying the #1103 ruling to the member references #2420 left behind: a
`ProtocolBase.<member>` cross-reference now reads `Protocol.<member>`, for one
consistent public vocabulary, and links there too.

Both halves move, because on the rendered page that is where the documentation
is. `protocol.rst` documents the members with nested
`autoproperty`/`automethod` directives under `.. autoclass:: ...Protocol`, so
`Protocol.<member>` carries the signature and the docstring; the `ProtocolBase`
block is `:no-members:` plus grouped `:no-index-entry:` stubs whose body only
links back to the `Protocol.*` entries, and the general index lists `Protocol.*`
alone. Measured on the pinned docs toolchain (`Sphinx==9.2.0`).

* 46 sites in `pcapkit/` and `docs/source/`. 37 move display *and* target to
  `Protocol.<member>`; the other 9 already targeted `Protocol` and only needed
  the display text. The explicit target is the fully-qualified spelling the
  house style asks for -- the form 124 existing references already use.
* `from_data` is consistent again: `internet.py` and `application.py` pointed
  at `ProtocolBase.from_data` where `link.py` and `transport.py` pointed at
  `Protocol.from_data` for the same kind of reference. All four now read alike.
* `__init_subclass__` keeps `ProtocolBase` (6 sites), since `Protocol`
  overrides it and naming `Protocol` would name a different method. So do
  `schema.py` and `protocol-layer-placement.rst`, whose adjacent prose would
  otherwise contradict itself, and `register`'s `Raises:` clause, which names
  the class the guard's `issubclass` tests (#2316/#1016).
* `changelog/1.5.0.rst` keeps its five `ProtocolBase.<member>` references.
  Each names the class a *built-in* protocol inherits the member from -- the
  built-ins derive from `ProtocolBase`, not `Protocol` -- and `CHANGELOG.md` is
  generated from that file by `util/changelog_md.py`, where a role flattens to
  a code span with no link, so moving them would rewrite release-note prose
  rather than an href.
* `tests/` and `examples/` are untouched (28 sites): their docstrings are not
  part of the Sphinx render.

Hrefs only. A role-canonicalisation guard reports no role and no display-text
change beyond the above, and an AST-structure guard (`ast.dump` with docstrings
stripped) is identical for every touched `.py` file.

…ce sweep, fix other prose drift (#2428)

Round 8 of the whole-repo prose sweep (#1103). Fanned out 8 shard agents by
directory; most of the repo was clean. Changes:

* pcapkit/protocols/internet/ipv6_ext.py + its .rst: finish the carry-over
  miss from round 7 -- the `_lookup_next_layer` plain pointer still targeted
  `ProtocolBase`, flipped to `Protocol` per #2420's ruling.
* Same miss in corekit/sentinels.py (`__keywords__`), docs/source/ext.rst
  (three sites, including a verbatim twin of a paragraph #2420 already fixed
  in protocol.py), schema/schema.py and schema/link/ethernet.py.
* internet.py, link.py, transport.py, sctp.py, protocol.py: `register()`'s
  Arguments: and a couple of Returns:/versionchanged clauses said `Protocol`
  subclass/instance while the signature types `ProtocolBase` and the
  adjacent Raises: clause already said so -- internal contradiction, fixed
  to `ProtocolBase` to match.
* docs/source/contributing/conventions/protocol-layer-placement.rst: the
  Link-Application-ProtocolBase set difference is `__proto_key__`, not
  empty as claimed (#2343 added it after this page was written).
* docs/source/contributing/conventions/registry-protocol.rst: "every
  registry overrides `_validate_value`" contradicted its own next
  paragraph, where the AppType transports inherit rather than override.
* pcapkit/vendor/ipx/packet.py, vendor/reg/linktype.py: a self-contradicting
  claim and a stale counted-number, both in vendor docstrings.
* docs/source/engines.rst, docs/source/conf.py, util/changelog_md.py,
  CONTRIBUTING.md: a stale scapy version, a wrong file path, a false
  "matches the Sphinx we build with" claim, and a missing caveat about
  actionlint making Lint non-advisory.

No executable code changed -- every edit is inside a docstring, comment, or
.rst file; confirmed by diff review and `import pcapkit` from this worktree.

Four behavioral defects found but deliberately left unfixed (reported
separately): 16 of 24 pcapkit/vendor crawlers' `process(self, data)` reads
the module-global `DATA` instead of its own `data` argument (latent,
harmless only because `request()` returns that same global); an empty
`FilterType` registry behind a live TODO; three open "handle this
programmatically" TODOs in pcapkit/vendor/mh; and dead `multiprocessing.Pool`
scaffolding in vendor/__main__.py.