dpdk: preserve kernel fallback for dynamic rx flows

[dleshchev]

Summary

• install the flow-isolation send-to-kernel fallback before programming dynamic RX flows
• track fallback installation per {port, group} so repeated dynamic flow updates do not duplicate the rule
• clear fallback tracking when programmed flows are destroyed

Fixes #205.

Validation

• git diff --check origin/main...HEAD
• IMAGE_TAG=daqiri:dynamic-rx-kernel-fallback BASE_TARGET=dpdk DAQIRI_ENGINE="dpdk ibverbs" scripts/build-container.sh

[greptile-apps]

Greptile Summary

This PR fixes a correctness gap where flow_isolation: true queues-only configs would black-hole unmatched control-plane traffic (ARP, SSH, etc.) once the first dynamic RX flow was added, because the send-to-kernel fallback was only installed for static startup flows. The fix installs the fallback (and the group-0 ETH jump) immediately before the first dynamic rule on each {port, group} pair, with deduplication so repeated flow additions don't create duplicate fallback rules.

• ensure_dynamic_flow_isolation_fallback_locked is called inside add_rx_flow_async and add_rx_flows_async (both under flow_lock_) and also enforces the invariant that standard IPv4/UDP and flex-item flows cannot mix groups on one interface.
• send_to_kernel_fallback_installed_ tracks installations per {port, group} and is cleared in destroy_programmed_flows, symmetric with the fallback flows being tracked in programmed_flows_; the ETH jump set (eth_jump_installed_) is intentionally not cleared because those flows are long-lived and managed separately.
• docs/api-reference/configuration.md is updated to describe the new dynamic-flow fallback behavior and the single-group batch constraint.

Confidence Score: 5/5

Safe to merge — focused bug fix with correct deduplication, lifecycle symmetry, and no new data-plane race conditions.

The implementation is correct: fallback installation is idempotent, the conflict check for mixed flow groups is sound, ordering (fallback before match rules) is right, and the clear-on-destroy symmetry between send_to_kernel_fallback_installed_ and eth_jump_installed_ matches their respective lifetimes. Both commits are DCO-signed and follow the required commit title format.

docs/tutorials/configuration-walkthrough.md (note 19) and AGENTS.md (Current limitations) still describe the send-to-kernel fallback as init-time only and should be updated.

Important Files Changed

Filename	Overview
src/engines/dpdk/daqiri_dpdk_engine.cpp	Adds ensure_dynamic_flow_isolation_fallback_locked to install the send-to-kernel fallback and ETH jump rule before the first dynamic RX flow is programmed; deduplicates via send_to_kernel_fallback_installed_ and clears tracking on destroy_programmed_flows. Logic is correct: conflict detection, ordering, deduplication, and the clear-on-destroy symmetry with eth_jump_installed_ all hold.
src/engines/dpdk/daqiri_dpdk_engine.h	Adds send_to_kernel_fallback_installed_ member set and declares ensure_dynamic_flow_isolation_fallback_locked; straightforward additions that mirror the existing eth_jump_installed_ pattern.
docs/api-reference/configuration.md	Updates the flow_isolation description to reflect that the first dynamic RX flow now installs the send-to-kernel fallback, and adds a note that mixing standard and flex-item flow classes is not supported within a dynamic batch. Change is accurate and consistent with the implementation.

_{Reviews (3): Last reviewed commit: "#205 - Support dynamic flex-item isolati..." | Re-trigger Greptile}