Add Ethernet transport with beacon discovery

Implement raw Ethernet transport using AF_PACKET SOCK_DGRAM on Linux
with EtherType 0x88B5 (IEEE experimental range) and 1-byte frame type
prefix (0x00=data, 0x01=beacon).

Transport implementation:
- EthernetConfig with interface, ethertype, MTU, buffer sizes, and
  four independent discovery knobs (discovery, announce, auto_connect,
  accept_connections)
- PacketSocket/AsyncPacketSocket wrappers with ioctl helpers for
  interface index, MAC address, and MTU queries
- EthernetTransport with Transport trait impl, async start/stop/send,
  receive loop dispatching data frames and discovery beacons
- Discovery beacons (34 bytes: type + version + x-only pubkey) with
  DiscoveryBuffer for peer accumulation and dedup
- Atomic statistics counters (frames, bytes, errors, beacons)
- Platform-gated with #[cfg(target_os = "linux")]

Transport-layer discovery integration:
- Promote auto_connect() and accept_connections() to Transport trait
  with default implementations and TransportHandle dispatch
- Extract initiate_connection() so both static peer config and
  discovery auto-connect share the same handshake initiation path
- Add poll_transport_discovery() to the tick handler to drain
  discovery buffers and auto-connect to discovered peers
- Enforce accept_connections() in handle_msg1() — transports with
  accept_connections=false silently drop inbound handshakes

Node integration:
- create_transports() handles Ethernet named instances
- resolve_ethernet_addr() parses "interface/mac" address format
- transport_mtu() generalized for multi-transport operation

Test harness:
- VethPair RAII struct for veth pair lifecycle management
- Three #[ignore] integration tests requiring root/CAP_NET_RAW:
  two-node handshake, data exchange, mixed transport coexistence
- Chaos harness: transport-aware topology model, VethManager for
  veth pairs between Docker containers, Ethernet-aware config gen,
  netem split (HTB+u32 for UDP, root netem for veth), transport-aware
  link flaps and node churn with veth re-setup
- Container entrypoint waits for configured Ethernet interfaces
  before starting FIPS (handles veth creation timing)
- New scenarios: ethernet-only (4-node ring), ethernet-mesh (6-node
  mixed UDP+Ethernet with netem and link flaps)

Documentation:
- fips-transport-layer.md: Ethernet section, beacon discovery, WiFi
  compatibility, updated discovery state, trait surface additions,
  implementation status table
- fips-configuration.md: Ethernet parameter table, named instances,
  peer address format, mixed UDP+Ethernet example, complete reference
- fips-wire-formats.md: Ethernet frame type prefix note

src/node/mod.rs

@@ -28,6 +28,8 @@ use crate::transport::{
     Link, LinkId, PacketRx, PacketTx, TransportAddr, TransportError, TransportHandle, TransportId,
 };
 use crate::transport::udp::UdpTransport;
+#[cfg(target_os = "linux")]
+use crate::transport::ethernet::EthernetTransport;
 use crate::tree::TreeState;
 use crate::upper::icmp_rate_limit::IcmpRateLimiter;
 use crate::upper::tun::{TunError, TunOutboundRx, TunState, TunTx};
@@ -107,6 +109,12 @@ pub enum NodeError {
 
     #[error("TUN error: {0}")]
     Tun(#[from] TunError),
+
+    #[error("index allocation failed: {0}")]
+    IndexAllocationFailed(String),
+
+    #[error("handshake failed: {0}")]
+    HandshakeFailed(String),
 }
 
 /// Node operational state.
@@ -570,8 +578,25 @@ impl Node {
             transports.push(TransportHandle::Udp(udp));
         }
 
-        // Future transports follow same pattern:
-        // for (name, tcp_config) in self.config.transports.tcp.iter() { ... }
+        // Create Ethernet transport instances
+        #[cfg(target_os = "linux")]
+        {
+            let eth_instances: Vec<_> = self
+                .config
+                .transports
+                .ethernet
+                .iter()
+                .map(|(name, config)| (name.map(|s| s.to_string()), config.clone()))
+                .collect();
+
+            let xonly = self.identity.pubkey();
+            for (name, eth_config) in eth_instances {
+                let transport_id = self.allocate_transport_id();
+                let mut eth = EthernetTransport::new(transport_id, name, eth_config, packet_tx.clone());
+                eth.set_local_pubkey(xonly);
+                transports.push(TransportHandle::Ethernet(eth));
+            }
+        }
 
         transports
     }
@@ -586,6 +611,55 @@ impl Node {
             .map(|(id, _)| *id)
     }
 
+    /// Resolve an Ethernet peer address ("interface/mac") to a transport ID
+    /// and binary TransportAddr.
+    ///
+    /// Finds the Ethernet transport instance bound to the named interface
+    /// and parses the MAC portion into a 6-byte TransportAddr.
+    fn resolve_ethernet_addr(
+        &self,
+        addr_str: &str,
+    ) -> Result<(TransportId, TransportAddr), NodeError> {
+        let (iface, mac_str) = addr_str.split_once('/').ok_or_else(|| {
+            NodeError::NoTransportForType(format!(
+                "invalid Ethernet address format '{}': expected 'interface/mac'",
+                addr_str
+            ))
+        })?;
+
+        // Find the Ethernet transport bound to this interface
+        let transport_id = self
+            .transports
+            .iter()
+            .find(|(_, handle)| {
+                handle.transport_type().name == "ethernet"
+                    && handle.is_operational()
+                    && handle.interface_name() == Some(iface)
+            })
+            .map(|(id, _)| *id)
+            .ok_or_else(|| {
+                NodeError::NoTransportForType(format!(
+                    "no operational Ethernet transport for interface '{}'",
+                    iface
+                ))
+            })?;
+
+        // Parse the MAC address
+        #[cfg(target_os = "linux")]
+        let mac = crate::transport::ethernet::parse_mac_string(mac_str).map_err(|e| {
+            NodeError::NoTransportForType(format!("invalid MAC in '{}': {}", addr_str, e))
+        })?;
+        #[cfg(not(target_os = "linux"))]
+        let mac: [u8; 6] = {
+            let _ = mac_str;
+            return Err(NodeError::NoTransportForType(
+                "Ethernet transport not available on this platform".into(),
+            ));
+        };
+
+        Ok((transport_id, TransportAddr::from_bytes(&mac)))
+    }
+
     // === Identity Accessors ===
 
     /// Get this node's identity.
@@ -640,18 +714,24 @@ impl Node {
         crate::upper::icmp::effective_ipv6_mtu(self.transport_mtu())
     }
 
-    /// Get the transport MTU from configuration.
+    /// Get the transport MTU for a specific transport.
     ///
-    /// Returns the MTU of the first configured UDP transport, or 1280
-    /// (IPv6 minimum) as fallback.
+    /// When called without a specific transport context, returns the MTU
+    /// of the first operational transport, or 1280 (IPv6 minimum) as
+    /// fallback. This is used for initial TUN configuration where a
+    /// specific transport isn't yet known.
     pub fn transport_mtu(&self) -> u16 {
-        self.config
-            .transports
-            .udp
-            .iter()
-            .next()
-            .map(|(_, cfg)| cfg.mtu())
-            .unwrap_or(1280)
+        // Prefer the MTU from the first operational transport
+        for handle in self.transports.values() {
+            if handle.is_operational() {
+                return handle.mtu();
+            }
+        }
+        // Fallback to config: try UDP first, then Ethernet
+        if let Some((_, cfg)) = self.config.transports.udp.iter().next() {
+            return cfg.mtu();
+        }
+        1280
     }
 
     // === State ===