Netcap v0.10.4 — FlightSim-qualified network detections

Adds bounded capture-time DNS DGA/tunneling, ICMP tunneling, TCP scans, SMTP fan-out, SSH transfer/nonstandard-port and protocol/policy findings, with versioned destination intelligence and analyst evidence. All 15 pinned FlightSim scenarios are qualified from an egress-disabled lab at 1/2/4/8 workers. C2 intelligence requires configured indicators; encrypted contents and malicious intent are not inferred. Shared UI 0.10.0 is published separately.

Includes macOS ARM64 DPI/no-DPI, Linux AMD64 glibc/musl DPI/no-DPI, Windows AMD64 no-DPI and corresponding third-party sources; verify checksums.txt. DPI binaries require their native dependencies. Hosted CI could not start due to the GitHub billing lock; artifacts were built and checked locally.

For the Ubuntu DPI container use dreadl0ck/netcap:ubuntu-v0.10.4-r1 (digest sha256:22024914ee98b65331863e2732fd125350a44a833628f3d9f5b6f0668de9e81e). The original ubuntu-v0.10.4 image omitted libprotoident/libtrace runtime dependencies; r1 includes the complete dependency chain and passes startup smoke testing. Published archives and the original versioned image were not overwritten.