Close the packaging, tooling and documentation long tail (B-33, B-34, B-37, C-06/18/19/20/21/22/23/24/27/28/33/35)

[fstubner]

B-37 — wrong subnet mask on multi-homed adapters

Windows adapter prefixes were matched by family only, so the first IPv4 prefix on an adapter was applied to every IPv4 address on it. An adapter with 192.168.1.5/24 alongside 10.0.0.5/8 reported one of them with the wrong mask — and anything deriving a subnet from that scanned the wrong range.

Now picks the longest prefix that actually contains the address, ignores a /0 default entry, and falls back to a host route rather than borrowing an unrelated mask.

That function is Windows-only, so Linux and macOS runners never compile it. The selection rule is pure, so it's mirrored as a testable function that runs everywhere, plus a Windows-only test asserting the mirror still agrees with the real one — otherwise the fix would be verified on one of three platforms.

Tooling gaps that were hiding real bugs

C-21 — tsc doesn't build project references, so tsconfig.node.json (covering vite.config.ts) was never typechecked. Switching to tsc -b immediately found a real error: the vitest test block added in an earlier PR isn't valid against vite's UserConfig. Also redirected the composite build's output so it stops emitting vite.config.js beside the source.

C-22 — no ESLint config or script existed at all. react-hooks is precisely the rule set that catches stale closures and wrong dependency arrays — the shape of A-13, B-16 and B-18. First run over a never-linted codebase: 2 errors, 3 warnings. Both errors fixed; the warnings are deliberate dep arrays and stay visible. Wired into CI.

Security and supply chain

• B-33 — dev scripts defaulted the Npcap SDK to C:\tmp, which is predictable and not ACL'd; a planted wpcap.lib there passes the existence check and links into the build. Now LOCALAPPDATA.
• B-34 — cargo install tauri-driver --locked was unpinned. --locked honours that crate's lockfile but not which version installs, so it floated to newest-at-job-time.

Correctness and docs

• C-06 — parse_file walked a multi-GB capture after max_packets just to count. Stopping early outright would under-report the "N packets" the GUI shows, so the count runs to completion for realistic files and gives up only past a 10M ceiling, where truncated already marks it a floor.
• C-23 — the core README example did not compile (wrong arity, wrong method, ? on an Option). Rewritten and verified by extracting the block and compiling it verbatim against the pinned toolchain.
• C-24 — NETSCLI_PCAP=1 curl … | bash scopes the variable to curl, so bash never saw it and the non-pcap build installed silently. Demonstrated: old form → unset, new form → 1.
• C-18/19/20/27/28/33/35 — missing Windows install paths, a dependency diagram that made netscli serve look impossible, a 404'd /vite.svg, an unignored multi-GB target-pcap/, a repo-wide *.csv plus a dead negation, stale example versions, and a packaging doc describing circular hash verification.

Verified, not assumed

B-29, B-30 and B-32 were already fixed in earlier work — I checked rather than re-fixing them.