fix(k8s): fall back to legacy iptables

[stephenlclarke]

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

Closes #2120.

Probe the nftables backend during node preparation. When the node kernel cannot use it, select the available legacy iptables and ip6tables alternatives before applying the MSS rules. This also keeps subsequent Kubernetes components on the working backend.

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

Negative control with the former hard-coded nft path: the behavior fixture exited unsuccessfully and applied neither fallback nor MSS rules.

• Shell behavior regressions for nft available/unavailable paths: 2/2 passed
• Full non-integration suite: 758 tests passed
• make fmt, make check, and git diff --check: passed
• Commit signature: verified

[stephenlclarke]

Rebased onto current main after K8sHelper was split into focused extensions. The fallback now lives in K8sHelper+Bootstrap.swift; the behavior and focused test coverage are unchanged.

Post-rebase validation:

• swift test --filter K8sNodePreparationTests: 2/2 passed
• git diff --check: passed
• rebased commit signature: verified

The PR is mergeable again. GitHub currently reports the workflow as action_required, so an Apple maintainer still needs to approve the fork-originated run.