docs(spec): record the delivered L2-only anchors and their residual

uBridge delivered `link l2only` (e2e3155) and the brctl delete refusal
(83a84fb); verified from the server side -- anchors and per-link bridges
report addrgenmode none, carry no addresses, and an idle anchor is silent
once the one-shot membership burst has settled.

That burst is the one thing the command cannot remove, so it is now recorded
where the acceptance criteria live, with the measurement: enslaving a port
makes the kernel announce the bridge's multicast memberships (90 B MLDv2 at
+0.00 s, 54 B IGMPv3 at +0.09 s, 90 B MLDv2 at +0.73 s, then silence; no
addresses involved, and IPv4 has no per-device IGMP switch). Decision:
accepted and documented, not suppressed -- §E.2 measures idle silence after a
settle window instead.

Pins the other delivered behaviour with a test: a bridge now survives a
single-sided node stop, so brctl create answers EEXIST on the common path
rather than only in a create race -- the attach must not short-circuit there,
because the restarted side has a brand-new anchor whose filters and markers
still have to be re-applied.

docs/features/qemu-kernel-datapath.md

@@ -148,8 +148,16 @@ enable_kernel_datapath = True
 Anchors are host-side netdevs, so the kernel gives them an IPv6 link-local
 address and emits MLD/DAD from them; those frames flood into the emulated
 segment. The hardening requirement (anchors must be pure L2, no L3 identity)
-is specified for uBridge in `docs/design/ubridge-l2-anchor-spec.md` — it
-applies to QEMU TAPs and Docker veths alike.
+is specified for uBridge in `docs/design/ubridge-l2-anchor-spec.md` and is
+**delivered**: anchors and per-link bridges come up with `addrgenmode none`,
+no addresses, and an idle anchor is silent (asserted in the e2e after a 2.5 s
+settle).
+
+One residual is accepted and documented there: enslaving a port makes the
+*kernel* announce the bridge's multicast memberships once — an IGMPv3 plus one
+or two MLDv2 reports in the first second — which floods into the segment like
+any L2 control frame. It stops; it is outside the L2-only command's reach (no
+addresses involved, IPv4 has no per-device IGMP switch).
 
 ## Roadmap