perf(tfork): use in-process nftables network locking- #10

[yiying-zhang]

Summary

• add --network-lock={iptables,nftables,skip} to crun tfork;
• expose --tfork-network-lock={iptables,nftables} in Podman live clone;
• default Podman tfork to CRIU's in-process nftables backend;
• retain iptables as an explicit compatibility fallback;
• reject skip in Podman's higher-level live-clone API; and
• add interleaved backend benchmarks plus a live-listener safety smoke test.

This changes the lock mechanism without weakening the packet-consistency
contract.

Performance

At exactly 100 processes, the measured critical-path medians were:

• network lock: 7.882 ms to 2.299 ms;
• network unlock: 59.298 ms to 12.629 ms;
• paired combined saving: 51.352 ms (52.150 ms mean).

Validation

• source and clone listeners both served after live clone;
• unsafe skip was rejected without harming the source;
• no stale CRIU nftables table remained;
• source/clone filesystem divergence passed;
• combined integration with transactional cleanup and futex Phase B passed.

Merge order

Merge fix/tfork-transactional-cleanup first.