test: cover the kernel-datapath review fixes

Regression coverage added with the fixes:
- capture-slot semantics: second-port refusal, failed-start rollback, and
  a non-owner port's stop not reaching `capture stop_kernel`;
- QEMU stop/start teardown on a mid-body or pre-launch failure, IOU start
  cleanup and filter guards, Dynamips half-attach undo plus retry;
- switch VLAN reconcile skipping a deferred anchor and rolling the
  ports_mapping back on failure;
- Docker/QEMU occupied-port refusal, probe ctime invalidation, probe
  survival of a failing uBridge start;
- env-marker dialects (mid-line mentions, falsy values) and the agent
  merge rejecting entries without a device_name.

Test-body imports of product modules move to the shared header.

tests/e2e/test_docker_link_local_frames.py

@@ -251,7 +251,8 @@ def _llprobe():
     if cc is None:
         pytest.skip("cannot build the raw-frame probe (no C compiler found)")
     try:
-        subprocess.run([cc, "-static", "-O2", "-o", binary, source], check=True, capture_output=True)
+        # S603: resolved compiler path, fixed argv, no shell
+        subprocess.run([cc, "-static", "-O2", "-o", binary, source], check=True, capture_output=True)  # noqa: S603
     except subprocess.CalledProcessError as e:
         pytest.skip(f"cannot build the raw-frame probe (cc -static): {e}")
     return binary