feat(docker): bpf packet filter on kernel links via cls_bpf match-drop

The GNS3 bpf filter (one expression per line, any line matching drops the
packet) now runs on the kernel datapath: uBridge's tc bpf_drop compiles
each line with libpcap (same compiler as the relay filter) into classic
BPF, attaches it to the veth host end's clsact egress as a cls_bpf
classifier with a gact TC_ACT_SHOT action, and the kernel migrates the
cBPF to eBPF internally -- no CAP_BPF needed.

- reconcile is flush + one add per line at priorities 10, 11, ... (OR
  semantics, same as the relay's per-line filters); tc reset (link
  delete / clear) is the full restore in uBridge and clears them
- capability-gated: the compute probes "tc capabilities" once per uBridge
  process (cached, invalidated on stop); without cbpf=1 the filter apply
  fails with an actionable upgrade error, and old uBridge builds without
  the tc module are never touched when no bpf filter is present
- a line that compiled for the controller's tcpdump but not for the
  compute's uBridge libpcap is skipped with a warning, mirroring the
  relay path
- KERNEL_UNSUPPORTED_FILTERS shrinks to frequency_drop (its eBPF stateful
  classifier is still pending, spec part B)

e2e (22/22): bpf "icmp" = 100% loss; size-discriminating expression
("greater 150") passes 98-byte and drops 300-byte pings (real byte-level
match); two-line OR; coexistence with netem (delay 50 -> small pings
100.2 ms while big dropped); clear removes clsact; suspend/resume keeps
the drops; link delete + recreate leaves no residual filters.

docs/design/ubridge-kernel-impairment-spec.md

@@ -3,10 +3,15 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 See LICENSE file for licensing information.
 -->
 
-> Frozen requirements spec for the **uBridge** project. The gns3-server side is
-> NOT implemented yet — it lands once uBridge delivers this surface. Everything
-> marked *shipped* already exists in uBridge 1.2.3+ and is verified against
-> gns3-server branch `feat/docker-kernel-filters`.
+> Frozen requirements spec for the **uBridge** project. Delivery status:
+> parts **A** (netem keyword extensions, uBridge `feature/tc-netem-ext`) and
+> **C + D** (cBPF match-drop, full-restore idempotent `tc reset`,
+> `tc capabilities` with `cbpf` probe — uBridge `feature/tc-bpf-drop`) are
+> **delivered and integrated** on gns3-server branch
+> `feat/docker-kernel-bpf-drop`. Part **B** (eBPF stateful classifier) is
+> still pending. The originally shipped netem surface (delay/jitter/loss/
+> dup/corrupt) exists in uBridge 1.2.3+ and is verified against gns3-server
+> branch `feat/docker-kernel-filters`.
 
 # uBridge kernel impairment: tc netem extensions + eBPF classifiers