feat(iol): anchor IOL runner containers on persistent TAPs

IOL runner containers (IOLDockerVM, GNS3_IOL_RUNNER) had no kernel
datapath: their guest leg is the runner's AF_UNIX socket pairs, so every
link rode the uBridge relay. Their Ethernet bays now own persistent TAP
anchors (gx names, the iol_docker key of the shared naming contract —
born at node start like IOU's, before any link, so the switch fast
path's deferred join can never miss them), and the per-port bridge's
topology leg swaps between UDP (relay) and the anchor (kernel link)
through the frozen stop -> delete -> add -> start contract — the unix
binding never re-binds across a swap.

- iol_docker_vm: KernelDatapathMixin hooks, the anchor lifecycle
  (_prepare_tap_datapath at _start_ubridge: probe ubridge_bridge_tap +
  ubridge_tap, sweep leftover, tap create born down), the kernel attach
  (ensure-then-add — tap create is strictly create-only, IFF_TUN_EXCL,
  so the ensure checks /sys/class/net first: an unconditional create
  answers EBUSY on the device the start loop just made), the release
  (port bridge stop + delete_nio_tap before the shared teardown) and the
  stop order the fd holders dictate (port bridges first, then tap
  delete, then the per-link bridges — all before the hypervisor stops).
- vendor_docker_vm: the port-bridge creation factored into
  _ensure_unix_port_bridge (idempotent on the registered name), keeping
  the NIOBridge rejection for the generic unix-socket containers.
- docker_vm: the three _kernel_veths lookups go through the
  _kernel_host_ifc hook — behavior-identical for DockerVM, and it is
  what lets the subclass route without overriding the binding methods.
- kernel_anchor: the iol_docker key (gx) and kernel_anchor_type, the
  controller-side mapping for naming an IOL runner's anchor on the
  switch fast path (the marker check stays inline: this module sits
  below everything and must not import the controller package).

tests/utils/test_kernel_anchor.py

@@ -21,7 +21,7 @@ Ethernet-switch link), plus the cascade veth naming for switch-to-switch
 links.
 """
 
-from gns3server.utils.kernel_anchor import anchor_suffix, kernel_anchor_name, kernel_cascade_names
+from gns3server.utils.kernel_anchor import anchor_suffix, kernel_anchor_name, kernel_anchor_type, kernel_cascade_names
 
 NODE_ID = "00010203-0405-0607-0809-0a0b0c0d0e0f"
 LINK_ID = "1a2b3c4d-5e6f-4a5b-8c9d-0e1f2a3b4c5d"
@@ -32,6 +32,22 @@ def test_every_node_type_has_its_own_prefix():
     assert kernel_anchor_name("qemu", NODE_ID, 1, 2) == "gq00010203e1p2"
     assert kernel_anchor_name("iou", NODE_ID, 0, 3) == "gi00010203e0p3"
     assert kernel_anchor_name("dynamips", NODE_ID, 6, 48) == "gd00010203e6p48"
+    assert kernel_anchor_name("iol_docker", NODE_ID, 0, 0) == "gx00010203e0p0"
+
+
+def test_anchor_type_keys_iol_runner_containers_apart():
+    """
+    IOL runner containers are Docker nodes whose anchors are persistent TAPs,
+    not veth host ends — their own key keeps the gv namespace free of TAPs.
+    The marker check must ignore a mere mention of the knob and survive a
+    multi-line environment.
+    """
+
+    assert kernel_anchor_type("docker", "GNS3_IOL_RUNNER=1") == "iol_docker"
+    assert kernel_anchor_type("docker", "GNS3_IOL_STARTUP_CONFIG=cfg.txt\nGNS3_IOL_RUNNER=1") == "iol_docker"
+    assert kernel_anchor_type("docker") == "docker"
+    assert kernel_anchor_type("docker", "GNS3_UNIX_SOCKET_NIO=1") == "docker"
+    assert kernel_anchor_type("qemu") == "qemu"
 
 
 def test_unknown_node_types_have_no_anchor():
@@ -62,7 +78,7 @@ def test_cascade_names_fit_ifnamsiz():
 
 
 def test_cascade_names_stay_out_of_the_node_anchor_namespace():
-    # "gs" cannot collide with any node anchor prefix (gv/gq/gi/gd), so a
+    # "gs" cannot collide with any node anchor prefix (gv/gq/gi/gd/gx), so a
     # cascade end is never mistaken for another node's anchor
     for end in kernel_cascade_names(LINK_ID):
-        assert not any(end.startswith(prefix) for prefix in ("gv", "gq", "gi", "gd"))
+        assert not any(end.startswith(prefix) for prefix in ("gv", "gq", "gi", "gd", "gx"))