Add TCP conversation completeness telemetry

[Adam-Ghanem]

Summary

• add bounded, payload-free TCP conversation completeness telemetry over NetWatch's native direction-aware tcp_history
• distinguish opening handshake evidence, observed data, closing evidence, complete conversations with/without data, incomplete captures, and truncated/missing history
• expose completeness in the unified flow investigation snapshot so the metric follows the analyst's active query
• keep incomplete conversations descriptive rather than treating partial captures as security findings

Rationale

Wireshark exposes TCP conversation completeness so analysts can quickly separate streams with observed opening/closing handshakes from partial captures. NetWatch already records bounded, direction-aware TCP history but did not turn that evidence into an investigation-level completeness view. This increment uses NetWatch's own metadata model and does not copy Wireshark code or representation.

Zeek's connection metadata similarly demonstrates the value of retaining bounded connection history for flow interpretation.

Validation

CI requested on the exact PR head. New regression coverage exercises complete-with-data, complete-without-data, incomplete/partial capture, missing/truncated history, bounds, invalid limits, and query-scoped investigation integration.

Safety

Metadata-only defensive analysis. No payload reconstruction, capture expansion, stealth, exploitation, credential testing, or active scanning behavior is added.