protocol: compare the NS prefix in place rather than through an uppercased copy (ibx#365)

[userFRM]

Problem

ns_parse uppercased the payload to test for a MISC prefix, then sliced the original at byte 4.

Uppercasing is not length-preserving: U+0131 and U+017F each occupy two bytes and uppercase to one ASCII byte. So a payload whose first four characters uppercase to MISC while occupying more than four bytes passed the check with byte 4 inside a character, and slicing a &str there panics.

Scope

The framed receive path does not reach it. is_ns_text admits only an ASCII digit or a literal MISC before dispatching here, so this hardens the parser for callers that hold it directly rather than closing a live crash.

What this changes

The prefix is compared in place against an ASCII MISC, and the remainder is taken with a checked slice.

The behaviour change is confined to the panic. The old code also recognised non-ASCII spellings, but it removed four bytes and each of those characters occupies two — so such a payload either put byte 4 inside a character, or shifted the cut so the remainder began mid-prefix and failed to parse. None of them ever parsed.

Also drops an allocation per inbound NS message on that path.

Tests

• a_prefix_that_changes_length_when_uppercased_does_not_panic — the hostile spellings plus the short and empty shapes. Fails by name against the previous parser.
• a_genuine_misc_prefix_is_still_stripped — the positive control, in any ASCII casing.
• the_prefix_is_an_ascii_misc_and_nothing_else and stripping_leaves_the_defined_shapes_alone — pin the boundary the prefix rule draws. Both agree with the previous behaviour, which is the point; the guard for the change is the panic test.

Closes #365.

Test plan

• Mutation: restoring the uppercased-copy parser fails a_prefix_that_changes_length_when_uppercased_does_not_panic by name.
• Positive control: a_genuine_misc_prefix_is_still_stripped, in any ASCII casing.
• the_prefix_is_an_ascii_misc_and_nothing_else and stripping_leaves_the_defined_shapes_alone pin the boundary the prefix rule draws; both agree with the previous behaviour, which is the point.
• cargo check --offline clean on --lib, --lib --features python, --bins, --examples, and each integration target individually.
• tests/ib_paper_compat compared against a clean checkout of the base commit — identical sorted diagnostic sets.
• cargo test --offline --lib — only the two known config::expiry_tests failures, which fail on the base commit for missing legacy tzdata (fixed separately in config: resolve the legacy timezone names IB states its times in (ibx#335) #336).