Add --meas-gsmtap: cell measurements into the PCAP as GSMTAPv3 signal reports

[shark-fi]

Summary

Adds a --meas-gsmtap flag (Qualcomm) that writes LTE and 5G-NR serving and neighbor cell measurements into the capture as GSMTAPv3 SIGNAL_STATUS_REPORT packets. Previously these ML1 measurement logs (0xB193/0xB197 LTE, 0xB97F NR) were emitted to stdout only and never reached the PCAP, so RSRP/RSRQ/RSSI were invisible in Wireshark.

Stacked on fgsect#150 (--cell-kv) — the measurement parsers and the RRC↔ML1 identity cache it introduces are shared. Base branch is feat/cell-kv-output; this PR shows only the --meas-gsmtap delta.

What it does

• util.build_signal_status_report() — builds a GSMTAPv3 SIGNAL_STATUS_REPORT (header + metadata, no payload): CHANNEL_NUMBER = earfcn/nrarfcn, BSIC_PSC_PCI = PCI, BAND_INDICATOR from the RRC identity join, and float metric tags. NR uses SS_RSRP/SS_RSRQ/SS_SINR; LTE uses RSRP/RSRQ/RSSI.
• LTE/NR ML1 serving + neighbor parsers emit one report per cell when --meas-gsmtap is set (one cp packet per detected cell). Independent of --cell-kv (stdout) and default off.
• Bug fix in util.create_gsmtap_header — the GSMTAPv3 metadata packer only handled type(v) == int, so the float metric tags (RSRP/RSRQ/SINR/…) raised TypeError for any fractional value and pre-packed bytes were the only non-int path. Reworked to pack floats as IEEE-754 and pass bytes through. This code path had no callers before this PR.

Example (decoded back out of a capture vector)

SIGNAL_STATUS_REPORT  CHANNEL_NUMBER=6300   BSIC_PSC_PCI=214  BAND_INDICATOR=20  RSRP=-101.25  RSRQ=-14.0625  RSSI=-66.625   (LTE serving)
SIGNAL_STATUS_REPORT  CHANNEL_NUMBER=397465 BSIC_PSC_PCI=710  SS_RSRP=-107.82  SS_RSRQ=-11.92                                (NR neighbor)

Notes

• Requires GSMTAPv3 (recent Wireshark) to dissect the reports; the packets are always emitted as v3 regardless of the global -3 flag, since SIGNAL_STATUS_REPORT has no v2 form. Mixing v2 (RRC) and v3 (signal reports) in one capture is fine — Wireshark dissects each GSMTAP packet by its version byte.
• The FREQUENCY metadata tag is intentionally omitted (the writer packs unknown tags as uint32, which overflows for NR mmWave Hz); CHANNEL_NUMBER identifies the carrier.

Tests

tests/test_meas_gsmtap.py decodes the emitted GSMTAPv3 packets and asserts the tags/values for LTE serving, LTE neighbor, and NR serving+neighbor, plus the float-packing helper and the default-off behavior. Full suite: 102 passing.

🤖 Generated with Claude Code

[shark-fi]

Note: this shows as merged, but its base (feat/cell-kv-output) was later force-reset to keep the upstream --cell-kv PR (fgsect#150) scoped correctly. The --meas-gsmtap work is in master via #4. No action needed.