ip_no_pmtu_disc controls PMTU discovery for UDP/ICMP paths only. TI=Z originates from ip_select_ident() in the kernel TCP stack setting IP ID=0 for DF=1 TCP packets — a namespace-scoped sysctl cannot change this. The previous commit was based on incorrect root-cause analysis.