Fix managed bridge forwarding and flat host ports

[chen21019]

Result

• allow managed CNI subnets to initiate forwarding while permitting only established or related replies
• restore Metadata and DNS reachability behind current Docker bridge filters
• masquerade only owned flat-L2 DNAT targets so host-port replies return through the publishing host
• enable loopback host ports only on the exact managed bridge and keep global firewall policy unchanged
• publish a checksum-covered image identity file with each release

Verification

• full Go unit/race test suite and validation scripts
• native nft lifecycle test in an unshared network namespace
• two Ubuntu 26.04.1 / Docker 29.8 VMs: native nftables and iptables-legacy
• bidirectional L2, localhost and peer host ports, Metadata, DNS, and egress through a valid lab gateway