fix(engine): count overflow and shutdown drops in packets, not queue copies (audit F6)

[donislawdev]

Audit finding F6. drop_overflow and drop_shutdown counted queue ENTRIES while both
tooltips promise "Packets".

_enqueue() runs once per element of dec.releases, and pipeline step 12 adds a second element
for a duplicate, so a duplicating session charged for the copy as well as for the packet.
Measured before the fix: seen=1000, duplicated=1000 -> drop_overflow=1900,
drop_shutdown=100. The "Buffer overflow" tile could read higher than the "Packets" tile beside
it in the same session.

What changed (beantester/engine.py only)

• _enqueue(release, packet, copy=False); heap entries carry the flag as a fourth element
  (release, counter, packet, copy). Ordering is unaffected: counter is unique, so tuple
  comparison never reaches index 2 or 3.
• stop() counts entries that are not copies instead of len(self._heap).
• The capture loop enqueues releases[0] directly and only branches into a loop for duplicates,
  so the single-release path (every session without duplication) does not pay for an enumerate.
• A refused copy no longer warns either. log.queue_overflow interpolates the counter, so
  warning on a copy would print "the TOOL is now dropping packets you did not ask to lose
  (0 so far)". Counter, log line and GUI banner now tell the same story, and a queue that
  refuses only copies is costing the user nothing.

Known, deliberate gap, recorded in the docstring rather than engineered away: if the original is
refused and the injector then frees a slot so the duplicate fits, the packet is delivered up to
20 ms late yet counted once as lost.

Verification

• python -m pytest tests -> 679 passed, 0 failed on an elevated shell (so zero failures is
  the full bar, not the two known non-admin ones). python smoke_gui.py -> OK.

• Two new guards in tests/test_engine.py, both verified by mutation: reverting each half of
  the fix turns them red with exactly the pre-fix numbers, drop_overflow=390 and
  drop_shutdown=400 against seen=200. Deterministic, not statistical: dup=100% fires on
  every packet and the 60 s latency releases nothing before STOP.

• Hot path measured before and after, back to back against a git worktree of master (Win11
  AMD64, CPython 3.14.6, 150k pre-built 1500 B packets through FakeDivert, median of 5):

  path	master	this branch
  no duplication	153.8k pkt/s (147.8-155.5)	156.0k pkt/s (149.3-157.7)
  100% duplication	100.9k pkt/s (97.6-104.2)	102.4k pkt/s (100.7-104.3)

  Medians moved about 1.4% in this branch's favour, but the per-run ranges overlap, so the honest
  reading is no measurable regression, not a speedup.

Not verified: behaviour under a real WinDivert overflow. The queue arithmetic is engine-side and
identical on either driver, so nothing here depends on the real path.

🤖 Generated with Claude Code