test(e2e): classifier spot check and filter persistence on TAP anchors

The filter matrix (cls_bpf, the eBPF classifier) only ran on Docker veth
host ends; the IOU and IOL-container scenarios now spot-check it on their
TAP anchors and prove a filter survives a node restart:

* bpf "icmp" drops everything with clsact on the anchor, both ends, and
  clears back to an empty qdisc;
* frequency_drop 3 (the eBPF every-nth mode) measured 56 % round-trip
  loss (1 - (2/3)^2 = 55.6 % expected) in both scenarios;
* the IOU test applies delay 100 before a router stop/start: the fresh
  anchor gets netem back (tc level) and the restarted router's pings
  measure RTT >= 150 ms until the filter is cleared (a re-attach that
  dropped the filter would show ~100 ms).

IOU file 492 s, IOL file 182 s, both green.

docs/features/iol-docker-kernel-datapath.md

@@ -140,6 +140,10 @@ isolated instance, real `iol-xe/iol-xe:17-18-02` images, real uBridge with
 * real ICMP crosses the [unix ↔ tap] port-bridge relay (100 % ping);
 * `delay 100` lands as netem on both anchors, measured RTT grows ≥ 150 ms
   and returns < 50 ms when cleared;
+* the classifier spot check on a TAP anchor (the Docker suite runs the full
+  matrix on veth host ends): `bpf "icmp"` drops everything (clsact on the
+  anchor), `frequency_drop 3` as the eBPF every-nth mode measured 56 %
+  round-trip loss (theory 55.6 %), both restoring on clear;
 * suspend admin-downs the anchor and kills the traffic; resume restores;
 * AF_PACKET capture writes a real pcap of the ICMP exchange;
 * link delete/re-create swaps the port bridge's TAP leg out and back in

docs/features/iou-kernel-datapath.md

@@ -146,10 +146,13 @@ The repository's live e2e suite carries the same scenario with **real
 IOU routers** (`tests/e2e/test_iou_kernel_datapath.py`, pytest marker
 `e2e`): a real L3 IOU image provides the fabric and the real IOS CLI on
 the server's telnet console, driving anchors-born-with-the-node, real ICMP
-through the port bridge, netem delay, suspend, capture, link
-delete/re-create, node stop/start rewiring, the serial link staying on the
-relay, and a relay negative control whose real `delay`/`frequency_drop`
-filters ride the port's `iol_bridge add_packet_filter` list.
+through the port bridge, netem delay, the TAP-anchor classifier spot check
+(bpf match-drop; the eBPF every-nth mode at 56 % measured round-trip loss,
+55.6 % expected), suspend, capture, link delete/re-create, node
+stop/start rewiring with a delay filter restored on the fresh anchor
+(tc and traffic both), the serial link staying on the relay, and a relay
+negative control whose real `delay`/`frequency_drop` filters ride the
+port's `iol_bridge add_packet_filter` list.
 
 The uBridge side passed its own 30/30 (`tests/iol/test_tap_anchor.py` in the
 fork), including the DOWN-anchor resilience and kernel-bridge interop this