Reuse runtime firewall detection in isolated VM gates

[chen21019]

Scope

• Host NAT and host-port opt-in VM tests use the runtime's read-only Docker firewall detection instead of requiring the newer FirewallBackend.Driver field.
• Remove the opposite-frontend probe that could load legacy modules on an nft-only host. Production firewall paths are unchanged.
• Document the isolated VM safety boundary in README.

Verification

• Targeted offline Go tests passed: internal/firewall, hostnat, hostports; git diff --check passed.
• Ubuntu 26.04.1 / Docker 29.8.0 isolated 10 GiB VMware VM, zero pre-existing containers:
  • Native nftables: both opt-in VM tests safely rejected the wrong backend; legacy kernel modules remained unloaded.
  • Clean Docker iptables-nft mode: TestIptablesNFTBatchOnVM and TestIptablesNFTOnDisposableVM passed; Docker NAT chain remained; no native Docker table or legacy modules were present.
  • Clean Docker iptables-legacy mode, explicitly selected only for this isolated test: TestIptablesLegacyBatchOnVM and TestIptablesLegacyOnDisposableVM passed; Docker legacy NAT chain remained; no native Docker table was present.
• GitHub test-build-scan, integrity, and CodeQL checks passed.
• VM restored to its pre-test native nftables snapshot; zero containers and legacy modules, original two snapshots retained; temporary snapshot removed.
• Test-only PR: no new runtime image is published or required.