fix(k8s): fall back to legacy iptables

[stephenlclarke]

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

Closes #2120.

Probe the nftables backend during node preparation. When the node kernel cannot use it, select the available legacy iptables and ip6tables alternatives before applying the MSS rules. This also keeps subsequent Kubernetes components on the working backend.

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

Negative control with the former hard-coded nft path: the behavior fixture exited unsuccessfully and applied neither fallback nor MSS rules.

• Shell behavior regressions for nft available/unavailable paths: 2/2 passed
• Full non-integration suite: 758 tests passed
• make fmt, make check, and git diff --check: passed
• Commit signature: verified

[stephenlclarke]

Rebased onto current main after K8sHelper was split into focused extensions. The fallback now lives in K8sHelper+Bootstrap.swift; the behavior and focused test coverage are unchanged.

Post-rebase validation:

• swift test --filter K8sNodePreparationTests: 2/2 passed
• git diff --check: passed
• rebased commit signature: verified

The PR is mergeable again. GitHub currently reports the workflow as action_required, so an Apple maintainer still needs to approve the fork-originated run.

[stephenlclarke]

Refresh 2026-08-26: rebased the single signed fix onto current main (d96dfa3), including the upstream K8sHelper split. New head: b2d773b. Focused K8sNodePreparationTests passed 2/2, and git diff --check passed.

[stephenlclarke]

Rebased cleanly onto current Apple main (d925dab865cf). The updated head is signed and remains one commit over the base: ea3c5f5a039ed90c2c3aa81a66a4b8bb7b261ed4.

Exact-head focused verification: swift test --jobs 4 --filter K8sNodePreparationTests — 2 focused tests passed; git diff --check passed and the worktree is clean. The broader test evidence already recorded in this PR remains unchanged; this update only incorporates the newer Apple base.

@codex review