feat(docker): unify adapter interfaces on veth, allow kernel links at runtime

Every Docker adapter is now born as a veth pair at container start
(unified interface) regardless of NIO type: guest end in the container
namespace, host end in the root namespace. Kernel links enslave the host
end into the per-link Linux bridge; relay links attach it to the uBridge
relay via AF_PACKET (bridge add_nio_ethernet) — the TAP path is gone.

This makes the datapath a runtime decision:
- links can be created on running containers (kernel or relay) without
  touching container interfaces — the controller stopped-node
  eligibility check is removed
- project reopen re-prepares relay links and upgrades eligible ones to
  the kernel datapath
- packet capture start/stop now key on the NIO type (not veth presence)
  so relay-over-veth captures use the relay capture, kernel ones the
  AF_PACKET module
- vendor unix-socket containers keep their wiring: no veth is required
  on the relay path

tests/controller/test_kernel_datapath_link.py

@@ -123,11 +123,16 @@ async def test_kernel_datapath_eligible_with_project_marker_definitions(project)
 
 
 @pytest.mark.asyncio
-async def test_kernel_datapath_not_eligible_for_running_nodes(project):
+async def test_kernel_datapath_eligible_for_running_nodes(project):
+    """
+    Docker adapters are born as veths (unified interface), so links attach
+    to running containers too — no stopped-node requirement.
+    """
 
     link, node1, node2 = await _kernel_link(project)
     node1._status = "started"
-    assert link._kernel_datapath_eligible(node1, node2) is False
+    node2._status = "started"
+    assert link._kernel_datapath_eligible(node1, node2) is True
 
 
 @pytest.mark.asyncio