refactor(compute): share the kernel-datapath machinery across node types

Move the datapath-agnostic half of DockerKernelDatapathMixin into a new
KernelDatapathMixin (compute/kernel_datapath.py) so a second node type can
reuse it verbatim: the three marker primitives, the tc netem / cls_bpf / eBPF
appliers, the uBridge tc-capability probe, kernel marker teardown, link
detach, the per-link bridge cleanup and the adapter carrier -- plus
_kernel_attach(), lifted from DockerVM._connect_nio's kernel branch.

The mixin talks about "the anchor" (the host-side interface an adapter owns in
the root namespace) instead of "the veth host end": a node type provides
_kernel_host_ifc(), _kernel_anchors() and, when needed, _relay_carrier_bridge()
and _kernel_error(). Docker keeps only the veth lifecycle and those hooks;
behaviour is unchanged.

The C901 baseline entry moves with _netem_command_parts (the docker module is
no longer over the limit) and the bpf-compile-failure test patches the logger
of the module that now owns the code -- net zero new ignores.

tests/compute/docker/test_docker_kernel_datapath.py

@@ -749,7 +749,7 @@ async def test_apply_bpf_drops_compile_failure_warns(vm):
             raise UbridgeError("209-Cannot compile filter 'icmp': can't parse filter expression: syntax error")
 
     vm._ubridge_send = AsyncioMagicMock(side_effect=send)
-    with patch("gns3server.compute.docker.docker_kernel_datapath.log.warning") as mock_log:
+    with patch("gns3server.compute.kernel_datapath.log.warning") as mock_log:
         await vm._ubridge_apply_bpf_drops(host_ifc, {"bpf": ["icmp"]})  # must not raise
     assert mock_log.called