dtls: drop recordless incomplete datagrams

[zRedShift]

Draft stacked on algesten#126.

This handles one narrow expected UDP/parser case: when an incoming datagram does not contain even one complete plausible DTLS record yet, handle_packet drops it as a no-op instead of surfacing ParseIncomplete.

This does not try to settle the broader public Error contract. In particular, it does not change ParseError, TooManyRecords, complete-record-plus-tail handling, replay transactionality, auto-server fallback policy, or add an is_transient() API.

Validation:

• cargo fmt --check
• git diff --check
• check-snowflake-local.pl origin/fix/error-taxonomy-transient
• cargo test --all-targets --features rcgen
• cargo clippy --all-targets --features rcgen -- -D warnings
• cargo test --no-default-features --features rust-crypto
• cargo clippy --no-default-features --features rust-crypto -- -D warnings
• cargo test --doc --features rcgen