transport/ethernet: rename config discovery flag to listen

Rename the Ethernet per-interface config flag from discovery to listen,
so the receive/transmit toggle pair reads as the symmetric announce
(transmit) / listen (receive) neighbor-beacon vocabulary. The old
discovery: key is still accepted via a serde alias, so deployed configs
load unchanged; to_yaml re-emits it under the canonical listen: name.
Marked deprecated for removal at the v2 cutover.

Updates the config field + accessor, the transport listen_enabled local,
the one struct-literal test consumer, the chaos sim config generator,
packaged fips.yaml examples, and the classified operator-facing docs
(ethernet neighbor-beacon subsystem prose; the generic Transport
discovery capability prose is left unchanged). Adds a compat parse test
asserting the legacy alias, the new key, and that deny_unknown_fields
still rejects unknown keys. Behavior-neutral.

docs/design/fips-transport-layer.md

@@ -262,7 +262,7 @@ UDP (1500 vs 1472 MTU).
 - **No IP dependency**: Operates below the IP layer. Nodes on the same
   Ethernet segment can communicate without IP addresses or routing
   infrastructure
-- **Broadcast discovery**: Nodes discover each other via periodic beacon
+- **Broadcast neighbor detection**: Nodes discover each other via periodic beacon
   broadcasts on the shared medium, with no static peer configuration required
 - **Higher MTU**: Standard Ethernet frames carry 1500 bytes of payload,
   yielding an effective FIPS MTU of 1499 after the frame type prefix
@@ -293,7 +293,7 @@ socket.
 | Addressing | 6-byte MAC address |
 | Platform | Linux only (`CAP_NET_RAW` required) |
 
-### Beacon Discovery
+### Neighbor Beacons
 
 Ethernet nodes discover peers via broadcast beacons sent to
 ff:ff:ff:ff:ff:ff. Each beacon is a 34-byte frame containing the sender's
@@ -301,7 +301,7 @@ x-only public key. Receiving nodes extract the MAC source address from the
 frame and the public key from the payload, then report the discovered peer
 to FMP.
 
-Four configuration flags control discovery behavior — `discovery`
+Four configuration flags control neighbor behavior — `listen`
 (listen for beacons), `announce` (broadcast beacons), `auto_connect`
 (initiate handshakes to discovered peers), and `accept_connections`
 (accept inbound handshakes). The flag table and per-flag defaults
@@ -310,13 +310,13 @@ under `transports.ethernet.*`.
 
 A typical discoverable node sets `announce`, `auto_connect`, and
 `accept_connections` all true. A passive listener uses just
-`discovery: true` to observe the network without announcing itself.
+`listen: true` to observe the network without announcing itself.
 
 ### WiFi Compatibility
 
 WiFi interfaces in infrastructure (managed) mode work transparently for
 unicast — the mac80211 subsystem handles frame translation between 802.11
-and 802.3. Broadcast beacon discovery is unreliable in managed mode because
+and 802.3. Broadcast neighbor detection is unreliable in managed mode because
 access points commonly isolate clients from each other's broadcast traffic.
 
 Startup logging:
@@ -895,7 +895,7 @@ transitions through `Starting` to `Up` (operational). `stop()` moves to
 | --------- | ------ | ----- |
 | UDP/IP | **Implemented** | Primary transport, AsyncFd/recvmsg, SO_RXQ_OVFL kernel drop detection |
 | TCP/IP | **Implemented** | FMP header-based framing, non-blocking connect, per-connection MSS MTU |
-| Ethernet | **Implemented** | AF_PACKET SOCK_DGRAM, EtherType 0x2121, beacon discovery, Linux only |
+| Ethernet | **Implemented** | AF_PACKET SOCK_DGRAM, EtherType 0x2121, neighbor beacons, Linux only |
 | WiFi | **Implemented** (via Ethernet transport, infrastructure mode) | mac80211 translates 802.11↔802.3; broadcast beacons unreliable through APs |
 | Tor | **Implemented** | Outbound SOCKS5, inbound via onion service, .onion and clearnet addressing |
 | Nym | **Implemented** | Outbound-only SOCKS5 through nym-socks5-client, mixnet anonymity, IP/hostname addressing |