fix(gtpu-dataplane): declare eBPF object license

[VerifiedOrganic]

The committed GTP-U eBPF object lacked an explicit kernel-readable license section. Add the 13-byte Dual MIT/GPL\0 declaration already used by the repository's other eBPF objects, validate it during build and CI, and regenerate the artifact from the current source.

The regenerated object has identical executable/map section bytes and normalized functional relocations to base 1dff851430c5671993e68aa3d81889402f2f5034; the symbol inventory adds only LICENSE. Its SHA-256 is 2b7a8d74e6a4c5fd61ed56185ed5b7dceda9d5ae30eec9d8a338fe590a20d994.

Refs #577.

Validation at ddffe07b2401a036869f3ab7a0a9c4bb0a8fa3ae:

• The pinned object build, license acceptance/rejection checks, full actionlint, ShellCheck, common/host tests, and affected Clippy pass. The build's LLVM-library fallback warning is retained in the evidence.
• All 37 current hosted checks pass, including the object rebuild and privileged Linux, Linux 6.8, and RHEL 9 / OpenShift checks.
• Required full local workspace validation failed: the mTLS target had 95 passed, 2 failed, and 4 ignored. Intentional admission loss changed a transport-failure counter; a later test hit a poisoned fleet lock. An exact-binary focused replay failed earlier during node configuration. Local privileged datapath execution is not claimed.

Current rebuild and focused evidence. Deferred pending reviewed testkit/session-network correction and complete required local/current hosted qualification. Full local failure and next steps.

[VerifiedOrganic]

Reconciled with current main and rebuilt the current classifier with the pinned nightly and bpf-linker. Current head is ddffe07b2401a036869f3ab7a0a9c4bb0a8fa3ae. The committed object's executable/map bytes and normalized functional relocations match current main; the symbol inventory adds only the explicit LICENSE object.

Local checks passed: pinned rebuild, valid/missing/tampered license cases, complete actionlint and ShellCheck, common and host dataplane tests, affected Clippy, formatting, and diff checks. The linker emitted its LLVM shared-library fallback warning, which is retained in the build evidence; the build exited successfully. The script's literal NUL-marker diagnostic now uses portable printf.

Current-head Linux 6.8, RHEL 9, privileged datapath, object-rebuild and general CI results remain required before merge. No local privileged datapath qualification is claimed.

[VerifiedOrganic]

Deferring current head ddffe07b2401a036869f3ab7a0a9c4bb0a8fa3ae as an open draft after a failed required local workspace gate. All 37 current hosted checks and the focused object/license checks pass, but the full local result is red.

cargo test --workspace --all-features --quiet -- --test-threads=4 exited 101 after 3463.36 seconds, with required fs-verity enabled and a private disk-backed XFS TMPDIR outside Git. The session-network library (576 passed, 2 ignored), session-store library (1124 passed), and consensus integration target (44 passed) completed successfully. The later multiprocess mTLS target finished with 95 passed, 2 failed, and 4 ignored:

• five_process_projected_mtls_unavailable_malformed_and_expiry_recovery failed at qualification_mtls_multiprocess.rs:7756: node 2 transport-failure counter changed from 0 to 2 during intentional consensus-admission loss.
• v9_snapshot_campaign_and_leaf_are_private_and_descriptor_pinned_across_replacement then failed on a poisoned fleet lock at line 11605.

One replay of the failed five-process case using the exact existing full-feature harness and child binaries failed earlier: node 0 exited during Configure sequence 1, with EOF / QualificationNodeConsensusFailed and 13 ms send elapsed. It did not reproduce the original counter mismatch. Both binaries, their SHA-256 hashes, original logs, and environment evidence are preserved. The harness, child-node implementation, and consensus-storage source are byte-identical to initial main 1dff851430c5671993e68aa3d81889402f2f5034; that does not establish a cause. Disk and inode capacity were healthy.

Next step for testkit/session-network maintainers: diagnose the admission-loss lifecycle accounting and the distinct child configuration failure in the original full-feature context, preserving deadlines, assertions, fs-verity, and failure classification. The PR maintainer should refresh after a reviewed correction and complete all required local and current hosted gates. The eBPF license repair is retained; the PR is not merge-qualified.