Move the capture tooling into the repo

live_capture.py and dump_pcap.py were untracked files inside the third-party
its-g5-receiver-firmware checkout, so the tools every on-air measurement depends
on were versioned nowhere and would vanish with a fresh clone of that project.
They are ours rather than that project's, so they now live in capture/, with the
setup notes rewritten as its README: which port the sniffer speaks on and why,
how to capture, how to check a capture, and how to flash the sniffer board.

live_capture.py carries the fix made on 2026-09-14. The sniffer's console
converts LF to CRLF on its way out, and that applies to every 0x0a byte of the
binary pcap stream, not only to log text, so every inserted CR shifts the rest
of the stream. A 787 KB capture parsed cleanly for only 82 of about 2000
records, and DENMs turned up on nonsense BTP ports because their payloads carry
0x0a often. undo_crlf() reverses it on the raw stream before any framing, which
is exact; afterwards a capture parsed to EOF and DENMs read as port 2002.
Captures taken before that date are truncated at their first corrupted record,
so anything measured from them is worth re-checking.

capture/recordings/ is gitignored, since captures are data rather than source.
The host tests now read both that directory and the older one in the receiver
checkout, so no capture has to be moved while it is being written.

dump_pcap.py reads the same console and still needs the same treatment; that is
recorded in TODO.md.

TODO.md

@@ -103,14 +103,14 @@ round-trip test and `asn1tools` for UPER cover what it would have checked.
 
 ## Follow-ups found 2026-09-14
 
-- [ ] **Commit the `live_capture.py` fix in the receiver repo.** Its console inserts a CR before
-      every LF, which also hits every 0x0a byte of the binary pcap stream, shifting pcap record
-      headers and frames. A 787 KB capture parsed cleanly for only 82 of ~2000 records, and DENMs
-      showed up on nonsense BTP ports. `undo_crlf()` now reverses it on the raw stream before
-      framing; afterwards a capture parsed to EOF and DENMs read as port 2002. This is the
-      "occasional byte inserted mid-frame" in the older recordings, so **every capture taken before
-      2026-09-14 is truncated at its first corrupted record** - re-measure anything derived from
-      them. The change is in the `its-g5-receiver-firmware` repo, uncommitted.
+- [x] **Capture tooling moved into this repo** (`capture/`), with the CR-insertion fix. The
+      sniffer's console inserts a CR before every LF, which also hits every 0x0a byte of the binary
+      pcap stream, shifting pcap record headers and frames. A 787 KB capture parsed cleanly for
+      only 82 of ~2000 records, and DENMs showed up on nonsense BTP ports. `undo_crlf()` reverses
+      it on the raw stream before framing; afterwards a capture parsed to EOF and DENMs read as
+      port 2002. **Every capture taken before 2026-09-14 is truncated at its first corrupted
+      record** - re-measure anything derived from them.
+- [ ] `capture/dump_pcap.py` reads the same console and still needs the same treatment.
 - [ ] **Do not open COM3's console while the phone is attached.** Opening it toggles DTR/RTS on the
       CH343 and resets the OBU, which drops the phone's USB link and needs a manual Connect.