Enforce the safety limits in the engines, not only in Ops

[fstubner]

Five bypasses found by the independent core review. Same shape in every case: Ops validated, the engine underneath did not — and the engines are re-exported at the crate root, so a consumer building input by hand reached them directly and the documented limits simply did not apply.

entry point	what was missing
PortScanner::scan_host	port cap, port-0 rejection
InspectEngine::inspect	same
DiscoverEngine::scan_subnet	/16 subnet cap
PcapEngine::capture	any required stopping condition
PcapEngine::parse_file	bound on retained packets
five constructors	panicked instead of clamping concurrency

Ops::resolve_ports even carried a doc comment claiming "every scanning entry point funnels through here so the limits hold no matter which surface the call arrives on". Two of them did not.

What each one cost

• A hand-built Vec<u16> skipped the 4,096-port cap and the port-0 rejection.
• scan_subnet("0.0.0.0/0") collects 4,294,967,294 addresses, roughly 73 GB, before sending a packet.
• PcapConfig has all-public fields and the helper guaranteeing a stopping condition lives in ops — so duration: None, max_packets: None gave a loop that only breaks on cancel, and capture takes no cancel token. It wrote until the disk filled.
• parse_file treated None as "retain every packet": a 500 MB file of 10M small frames built 10M summaries, ~5 GB, each with a 191-char hex preview.
• concurrency.max(1) left the upper bound to Semaphore::new, which asserts above usize::MAX >> 3. Absurd input, but a constructor returning Self cannot report an error, so it aborted the process.

Signature changes

Both land in the unreleased 0.3.0:

PortScanner::scan_host{,_with_progress}       -> Result<Vec<PortResult>>
DiscoverEngine::scan_subnet{,_with_progress}  -> Result<Vec<Host>>

SweepEngine treats a per-host scan error as "no open ports" rather than aborting the sweep: the port list is validated once by the caller, so a failure there would be the same error repeated for every host.

capture::capture was left unreachable by routing capture through capture_with_cancel, so it is deleted rather than kept as dead code.

Verification

Four new tests in config_safety.rs pin the engine-level checks, because every one of these is silent — the old code returned results rather than failing.

151 tests pass; cargo fmt and clippy clean with and without pcap.