docs(ubridge): the fifth L2-only creator, and the call site that used it

The spec's B table grows its fifth row: bridge add_nio_tap mints a
transient TAP when the name is free and hardens it at creation, while an
attach to an existing device (possibly a user-owned TAP with addresses)
is left untouched. The rule paragraph spells out attach-is-not-a-creation.
Delivery: uBridge fb72758, closing the gap the new e2e assertions found
(live: the switch's gns3*-0 relay TAP carried fe80::). The server issues
no link l2only of its own -- the switch call site now documents that the
TAP is minted-and-hardened by add_nio_tap, and the ESW feature doc
describes the uBridge-side close instead of a server workaround.

docs/features/ethernet-switch-kernel-datapath.md

@@ -41,6 +41,15 @@ on the relay:
   `GNS3_UNIX_SOCKET_NIO` containers);
 * cross-compute links, non-Ethernet ports: the common rules.
 
+**Relay port TAPs.** The switch's own relay-path port TAPs (the
+`gns3{id}-N` devices) are created *implicitly* by uBridge's
+`bridge add_nio_tap` — a name that is free is minted as a transient TAP,
+and uBridge hardens it L2-only at creation (the fifth creator of
+`docs/design/ubridge-l2-anchor-spec.md` §B, uBridge `fb72758`). The server
+issues nothing extra: without that hardening the device would take a
+kernel-default IPv6 identity whose DAD/MLD noise floods the segment, which
+is exactly what the e2e's relay-control §E.1 assertion guards against.
+
 ## The wire format: one NIO names the other end's interface
 
 ```