feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

docs/design/ubridge-kernel-impairment-spec.md

@@ -293,13 +293,23 @@ old uBridge without these commands simply stays on the relay datapath):
 
 ```
 tc capabilities
-100-netem=delay,jitter,loss,dup,corrupt,rate,reorder,gemodel,dist,seed,limit;ebpf=1;cbpf=1
+100-netem=delay,jitter,loss,dup,corrupt,rate,reorder,gemodel,dist,seed,limit;ebpf=1;cbpf=1;ebpf_modes=nth,quota,window,flow
 ```
 
 `ebpf=0` when the load probe fails at startup (kernel < 5.1 or no CAP_BPF);
 `cbpf=0` when RTM_NEWTFILTER/cls_bpf is unavailable. gns3-server hides the
 corresponding filter types per capability.
 
+`ebpf_modes` (added on uBridge `feature/tc-window`, commit 40c36ae) is a
+build fact, orthogonal to the runtime probes: the same binary flips `ebpf`
+between users and kernels while the mode set changes only with the binary.
+A mode is usable iff `ebpf=1` **and** its token is listed — gating
+`window_drop` on `ebpf=1` alone silently accepts the 4-arg form on a
+pre-correction build (`feature/tc-precision`: back-to-back windows, no
+gap). Builds that do not emit the field at all predate it and get legacy
+treatment; an incompatible mode revision renames its token
+(`window` → `window2`) rather than versioning in place.
+
 ---
 
 ## F. Test requirements
@@ -338,6 +348,14 @@ corresponding filter types per capability.
   mirrors the grammar's `period ≥ outage` rule and treats `start = 0` as
   active (an immediate outage).
   Not yet exposed: `flow_drop` (parameter-shape UX decision).
+* **Done** (capability reporting): the `ebpf_modes` contract is consumed
+  end to end — the compute applies it per mode (window requires its token;
+  pre-field builds keep their shipped modes), the compute
+  `GET /capabilities` payload reports `ubridge_tc` through a standalone
+  spawn-as-own-user probe cached by binary identity, and the controller's
+  `available_filters` hides kernel-datapath filter types an endpoint
+  compute reports it cannot run (computes without a report keep the full
+  list; apply-time 409 stays the guard).
 * Every veth end owns one qdisc + its filters: per-direction impairment is
   an architectural freebie to expose later (API `direction` field), aligned
   with marker `dir` semantics.