feat(docker): bpf packet filter on kernel links via cls_bpf match-drop

The GNS3 bpf filter (one expression per line, any line matching drops the
packet) now runs on the kernel datapath: uBridge's tc bpf_drop compiles
each line with libpcap (same compiler as the relay filter) into classic
BPF, attaches it to the veth host end's clsact egress as a cls_bpf
classifier with a gact TC_ACT_SHOT action, and the kernel migrates the
cBPF to eBPF internally -- no CAP_BPF needed.

- reconcile is flush + one add per line at priorities 10, 11, ... (OR
  semantics, same as the relay's per-line filters); tc reset (link
  delete / clear) is the full restore in uBridge and clears them
- capability-gated: the compute probes "tc capabilities" once per uBridge
  process (cached, invalidated on stop); without cbpf=1 the filter apply
  fails with an actionable upgrade error, and old uBridge builds without
  the tc module are never touched when no bpf filter is present
- a line that compiled for the controller's tcpdump but not for the
  compute's uBridge libpcap is skipped with a warning, mirroring the
  relay path
- KERNEL_UNSUPPORTED_FILTERS shrinks to frequency_drop (its eBPF stateful
  classifier is still pending, spec part B)

e2e (22/22): bpf "icmp" = 100% loss; size-discriminating expression
("greater 150") passes 98-byte and drops 300-byte pings (real byte-level
match); two-line OR; coexistence with netem (delay 50 -> small pings
100.2 ms while big dropped); clear removes clsact; suspend/resume keeps
the drops; link delete + recreate leaves no residual filters.

tests/controller/test_kernel_datapath_link.py

@@ -103,8 +103,9 @@ async def test_kernel_datapath_eligible_with_netem_filters(project):
 @pytest.mark.asyncio
 async def test_kernel_datapath_not_eligible_with_relay_only_filters(project):
     """
-    frequency_drop and bpf only exist in the uBridge userspace relay — a
-    link carrying one stays on the relay.
+    frequency_drop only exists in the uBridge userspace relay (its eBPF
+    classifier is not delivered yet) — a link carrying one stays on the
+    relay. bpf is kernel-capable (cls_bpf match-drop) and eligible.
     """
 
     link, node1, node2 = await _kernel_link(project)
@@ -112,7 +113,7 @@ async def test_kernel_datapath_not_eligible_with_relay_only_filters(project):
     assert link._kernel_datapath_eligible(node1, node2) is False
 
     link._filters = {"bpf": ["icmp"]}
-    assert link._kernel_datapath_eligible(node1, node2) is False
+    assert link._kernel_datapath_eligible(node1, node2) is True
 
 
 @pytest.mark.asyncio
@@ -267,8 +268,25 @@ async def test_update_relay_only_filters_rejected_on_kernel_link(project):
 
     with pytest.raises(ControllerError, match="kernel-datapath"):
         await link.update_filters({"frequency_drop": [10]})
-    with pytest.raises(ControllerError, match="kernel-datapath"):
-        await link.update_filters({"bpf": ["icmp"]})
+
+
+@pytest.mark.asyncio
+async def test_update_bpf_filters_accepted_on_kernel_link(project):
+    """
+    bpf expressions ride the kernel NIO to BOTH endpoints (each end's
+    cls_bpf classifiers cover the traffic entering that container — the
+    same both-directions-once net effect as the relay's single filtered
+    bridge).
+    """
+
+    link, node1, node2 = await _kernel_link(project)
+    await link._prepare()
+
+    await link.update_filters({"bpf": ["icmp\nudp port 53"]})
+    assert link.filters == {"bpf": ["icmp\nudp port 53"]}
+    by_node = {entry[0].id: entry[3] for entry in (await link._prepare())}
+    assert by_node[node1.id]["filters"] == {"bpf": ["icmp\nudp port 53"]}
+    assert by_node[node2.id]["filters"] == {"bpf": ["icmp\nudp port 53"]}
 
 
 @pytest.mark.asyncio