docs(spec): require L2-only host anchors in uBridge

Every host-side device uBridge creates for the data plane (persistent TAP
anchors, veth host ends, per-link kernel bridges) must be pure L2: no IPv4
address, no IPv6 address and no IPv6 stack activity on that device.

Measured today: an idle TAP emits ~6 frames / 2 s of the host's own MLD/DAD
from its own link-local, the production Docker veth host end carries
fe80::5c30:e8ff:fe00:5d8d/64 and the per-link bridge fe80::f0d9:94ff:feac:e42b/64.
On a kernel link the bridge floods those frames into the emulated segment, on a
relay link uBridge relays them to the peer, and the host answers neighbor
solicitations for its own address (a phantom IPv6 neighbour for the emulated
nodes). IPv4 needs no equivalent knob: nothing self-provisions it, and the
anchors hold no IPv4 address.

The spec adds one command (link l2only <iface> [on|off], netlink addr-gen-mode
none -- never a /proc sysctl write, which fails the DAC check for a non-root
setcap'd uBridge), applied by the four creators themselves, with an
idle-silence acceptance test and a known-noise note in the Docker kernel
datapath document. No change to existing command grammar.

docs/features/docker-kernel-datapath.md

@@ -163,6 +163,15 @@ reopen flips the field. It is not persisted and never sent on create/update.
   orphan. Both endpoints do this and the peer's still-enslaved port makes
   the delete fail with EBUSY (suppressed, last one wins), the same contract
   as link deletion; a node restart rebuilds the bridge from the NIO.
+* **Host L3 noise (known, hardening specified).** An anchor is a host-side
+  netdev like any other, so the kernel gives it an IPv6 link-local address and
+  emits its own MLD/DAD from it (measured ≈6 frames / 2 s on an idle TAP; the
+  production anchors and per-link bridges carry `fe80::…` today). On a kernel
+  link the bridge floods those frames into the emulated segment — and the host
+  answers neighbor solicitations for its own address, which looks like a phantom
+  IPv6 neighbor to the emulated nodes. The fix is to make anchors pure L2 at
+  creation time on the uBridge side:
+  `docs/design/ubridge-l2-anchor-spec.md`.
 
 ## Link operations