Synthetic test fixture for Zeek idle TCP split verification.

Generated with:
1. python3 research/validation/mkpcap_idle.py /tmp/zeek_split_gen/pcap/idle.pcap
2. docker run --rm --user "$(id -u):$(id -g)" \
     -v /tmp/zeek_split_gen/pcap:/pcap:ro -v /tmp/zeek_split_gen/out:/out -w /out \
     zeek/zeek:9.0.1 zeek -C -r /pcap/idle.pcap

Contains one TCP session (10.0.0.5:40000 -> 203.0.113.9:443) split by Zeek 9.0.1 across a 600s idle gap into two conn.log lines:
- First line: ts=1793400000.000000, duration=1741.050000, history=ShADd
- Second line: ts=1793402401.000000, duration=1800.050000, history=DdFfA (no 'S' in history, gap = 659.95s <= 3600s)

Expected chained session: L = 4201.05s, parts = 2.
