timing-lab: packet surfaces probe the non-path entry points; noq traffic uses _for_path

[lann]

Found while re-evaluating the QUIC split after the noq migration (#25).

The timing lab's packet-protection surfaces (packet/{suite}/seal, open-reject) drive encrypt_in_place/decrypt_in_place (timing-lab/src/main.rs:651,660,671,1146,1170,1389). Since #25, production traffic never takes those entry points: noq-proto routes every packet — multipath negotiated or not — through encrypt_in_place_for_path/decrypt_in_place_for_path (rust/quic/src/packet.rs), which differ in nonce assembly (the draft-ietf-quic-multipath-11 construction: path ID XORed into the IV's first four bytes ahead of the packet number).

The class argument says the paths are timing-equivalent — same AEAD core, the nonce assembly is fixed-shape XOR — but the lab exists because arguments are not measurements, and its verdicts should attach to the entry points deployments exercise.

• Switch the packet rig's seal/open probes to the _for_path methods (path 0, matching single-path deployments), or probe both entry points if the marginal runtime is acceptable.
• Header protection is unaffected (no path-aware variant); the retry/token surfaces are unaffected.