[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• refactor — changes neither behaviour nor performance

---

Description of your pull request and other information

As the owner ruled on #2622, pcapkit.foundation.analysis is a public layer over protocol methods and holds no parsing of its own. DTLS now matches IP and TCP:

• The rebuild-and-fallback logic in foundation.analysis.dtls._read_handshake moves into the classmethod DTLS.analyze_handshake.
• dtls_handshake and the reassembly Deferred both call that classmethod, the Deferred through the engine's __protocol_type__.
• The convention is written onto reassembly-integration.rst as "Parse Ownership". A new guard fails on any import of pcapkit.foundation under pcapkit/protocols/ outside TYPE_CHECKING, except registry.protocols.

Output is unchanged: 68 test-vector datagrams, 40 synthetic vectors and every sample capture match, including pickle round trips. One fix comes with the move. On main, an undecodable handshake body logged CRITICAL and replaced sys.excepthook/threading.excepthook. It is now a quiet refusal, per #2588's rule.

A custom engine's __protocol_type__ now decides the DTLS parse, as it does for IP and TCP, and must define analyze_handshake. foundation.analysis is in no release. A Sonnet cross-review reproduced the differential and the guard mutations; its fixes are folded in.

Closes #2622

[JarryShaw]

GOOD TO GO at e05e7a447, from a Sonnet cross-review.

• Behaviour. It reproduced the DTLS differential (72 datagrams, 0 mismatches) and confirmed pickle round trips.
• Quiet-refusal fix. On main, a malformed handshake body logs CRITICAL and installs excepthooks. Here it logs nothing and installs no hooks.
• Import guard. Seven injection forms each failed the guard.
• Review fixes folded in:
  • the heading is now "Parse Ownership";
  • the module docstring is fixed;
  • the guard exempts only registry.protocols;
  • the __protocol_type__ requirement is documented;
  • Handled Refusals names the explicit-CaughtByCaller case.
• Rebase. It is rebased past feat(application): dissect RFC 9146 connection-ID DTLS records #2631 with a mechanical import merge; the patch-id outside dtls.py is unchanged.