ECMP Classification & Flow Attribution Hardening

This release fixes how ttl handles ECMP (Equal-Cost Multi-Path) load balancing, particularly per-packet ECMP common on Arista, Juniper, and Cisco switches. Previously, users would see "Paths: 1" in the main table despite 8+ responders visible in the hop detail view.

Added

• ECMP classification — Detects per-flow vs per-packet ECMP using primary concentration heuristics. Paths column now accurately reflects observed responder count for per-packet load balancing (#46)
• E indicator — New ECMP indicator in main table replaces misleading ! (route flap) when ECMP is the actual cause
• Effective flow capability — Runtime detection of protocol flow support. --flows > 1 with ICMP now warns and collapses to single-flow instead of silently doing nothing
• Receiver flow attribution hardening — Out-of-range source ports (NAT/CGNAT) no longer force-attributed to flow 0. Unknown-flow responses only match pending probes when unambiguous
• Hop detail view — Per-packet ECMP section shows responder count and path count; per-flow ECMP section unchanged
• Last RTT semantics documented — Last column tracks primary responder's most recent RTT
• Main table layout guard tests — Header/cell/width count parity verified across display mode x flow mode matrix
• IPv6 RAW payload fallback tests — Echo Reply and Time Exceeded parsing tests for IPv6

Changed

• Flap detection suppressed during ECMP — ! indicator no longer fires when per-packet ECMP is detected at a hop
• Probe engines use per-session config — Each target's engine sees the effective flow count, not the raw CLI value

Full Changelog: https://github.com/lance0/ttl/compare/v0.17.0...v0.18.0