feat(profiler): wire p0f-v2 matcher into sniffer_rollup priority chain

The ~30-signature hand-rolled p0f-lite table in decnet/sniffer/p0f.py
misses most real-world attackers (yesterday's SLOW SCAN being a
textbook case — 9 hours of events, 19 hits, os_guess = NULL). The
375-sig vendored p0f v2 DB was already there; this commit actually
calls it.

New resolution chain in sniffer_rollup:

  1. Enabled OS-fingerprint providers (p0f-v2 default, via
     DECNET_OSFP_PROVIDERS) tried in declared order. Provider with
     highest-confidence match across all enabled sources wins.
  2. Modal os_guess label from the sniffer's hand-rolled p0f.py.
     Kept as fallback because v2's DB predates post-2006 kernels.
  3. TTL bucket (linux / windows / embedded). Coarse but never wrong.

Wiring details:

- _match_via_osfp_providers: never raises — factory / provider
  failures collapse to None and the chain falls through to the
  old modal-label / TTL path. A corrupt .fp file or misconfigured
  DECNET_OSFP_PROVIDERS must never wedge a profile rebuild.
- tcp_fp_context tracks whether the LATEST tcp_fp snapshot came
  from a passive SYN ('syn' → p0f.fp) or an active prober probe
  ('synack' → p0fa.fp). Routes to the right sig list.
- initial-TTL normalisation via decnet.sniffer.p0f.initial_ttl.
  Observation's TTL may be N hops below the OS's initial; v2
  signatures match on the canonical bucket.

Soft-field semantics on Signature.score(): df and total_len are now
skip-checked when the observation is missing them. Sniffer doesn't
currently emit either SD field; a literal-constraint sig
shouldn't hard-reject a match solely because of upstream
incompleteness. Hard fields (window, ttl, options_sig, quirks)
still hard-reject on absent/mismatched input — those are the real
discriminators. Promote df / total_len back to hard the moment the
sniffer starts emitting them.

+2 integration tests on TestSnifferRollup, +2 soft-field tests on
test_signature. Full regression: 166 tests across tests/prober/osfp
+ tests/profiler all green.

tests/prober/osfp/test_signature.py

@@ -63,6 +63,21 @@ def test_score_df_wildcard_on_signature_matches_either() -> None:
     assert sig.score(_obs(df=False)) is not None
 
 
+def test_score_df_none_on_observation_is_soft_skip() -> None:
+    """When the observation lacks df (sniffer doesn't emit it today),
+    a signature with a specific df constraint must still match rather
+    than hard-reject. Rationale in the score() docstring."""
+    sig = _parse_line("5840:64:1:60:M1460,S,T,N,W7:.:Linux:df-required")
+    assert sig.score(_obs(df=None)) is not None
+
+
+def test_score_total_len_none_on_observation_is_soft_skip() -> None:
+    """Same soft-field semantics for total_len — the profiler adapter
+    passes None when the sniffer / prober didn't capture it."""
+    sig = _parse_line("5840:64:1:60:M1460,S,T,N,W7:.:Linux:len-specific")
+    assert sig.score(_obs(total_len=None)) is not None
+
+
 def test_score_options_order_mismatch_returns_none() -> None:
     sig = _parse_line("5840:64:1:60:M1460,S,T,N,W7:.:Linux:ordered")
     # Same tokens, different order — must NOT match.