test(e2e): live coverage for markers on the kernel datapath

Two Alpine containers on a kernel-only link with traffic-insight markers
attached to a veth anchor (marker add_kernel), observed on the dedicated
marker WebSocket via a new harness piece (WebSocketCollector, a sync
facade over websockets' sync client). Real ICMP proves: the marker.match
identity is complete (filter/tag/link_id/capture node/ts/len and the
tx/rx direction set of a ping), the main project channel carries no
matches, the BPF and direction are enforced (a non-matching sibling and
a tx-only marker each see exactly their traffic), the host pcap holds
exactly the matched frames, pausing silences one marker while a sibling
keeps counting (silence is never a dead channel), tag replay serves the
paused tag's timeline with display-filter/link/window narrowing and
refuses with 409 while capturing, and deleting a marker takes its pcap
and signals with it.

docs/features/marker-tag-replay.md

@@ -314,6 +314,12 @@ All error bodies are `{"message": "…"}` (the app's unified format).
 
 ## Notes
 
+- **In-repo e2e coverage (2026-10).** `tests/e2e/test_marker_kernel_datapath.py` exercises
+  the whole contract against a paused tag on real marker pcaps: the `range` aggregate
+  (frame_count, sources inventory with the node/link/marker identity, first-frame
+  src/dst/proto from sharkd), the display filter narrowing (`icmp.type == 8`), the
+  unknown-link empty stream, the `frames` window endpoint, and the 409 gate while a
+  marker under the tag is still capturing.
 - **Heterogeneous link types coexist.** Frames are never merged into a single pcap
   (mergecap is deliberately not used) — each frame carries its source and is decoded
   individually, so Ethernet and serial (cHDLC/PPP) markers can share one timeline.

docs/features/marker-traffic-insight.md

@@ -344,6 +344,15 @@ direction relative to the capture node; see [Direction](#direction).
 
 ## Notes
 
+- **Live e2e coverage.** `tests/e2e/test_marker_kernel_datapath.py` drives two real
+  Alpine containers over a kernel-only link with markers attached to a veth anchor
+  (`marker add_kernel`): it asserts the exact `marker.match` identity on the dedicated
+  marker WebSocket (filter/tag/link_id/node_id/ts/len and the tx/rx direction set of a
+  ping), that the main project channel carries no `marker.match`, that a non-matching
+  BPF and a `tx`-directioned sibling each see exactly their intended traffic, the host
+  pcap frame count, pause/resume silence counting against a still-firing sibling,
+  marker delete removing the pcap and silencing signals, and the empty marker
+  directory at the end.
 - **Marker name is immutable.** It is the identifier across the controller, the uBridge
   filter, the pcap filename, and `MARK` signal routing — so rename is a delete + recreate,
   not a field update. PUT ignores the body `name`; the `{name}` path parameter identifies