Switch kube-proxy to nftables mode and add missing kernel config options
(NFT_NUMGEN, NFT_FIB_IPV4/6, NFT_LIMIT, NFT_REDIR, NFT_TPROXY) plus
xtables match modules required by CNI bridge masquerade. Add stale CNI
state cleanup on boot (cni0 bridge, veth pairs, IPAM allocations, pod
network namespaces, sandbox controller shim) to prevent 'route already
exists' errors from persistent rootfs. Remove dual bridge/legacy-vm-net
profile system in favor of bridge-only with fail-fast kernel validation.
Drop host-mapped port 6443 (kube-apiserver) since it is not needed for
normal gateway operation. Update bundle script to fall back to Homebrew
for libkrun.dylib (VMM) while still requiring custom libkrunfw (kernel).
Enable Kubernetes-compatible networking in the gateway microVM by
building a custom libkrunfw kernel with CONFIG_BRIDGE, CONFIG_NETFILTER,
CONFIG_NF_CONNTRACK, CONFIG_IP_NF_IPTABLES, and CONFIG_VETH compiled in.
Key changes:
- Docker-based kernel build pipeline for macOS (build-custom-libkrunfw.sh)
- Kernel config fragment enabling bridge/netfilter/conntrack/NAT/IPVS
- Feature-flagged bridge CNI with auto-detection fallback to legacy ptp
- Runtime provenance tracking (SHA-256, build metadata, manifest validation)
- VM capability checker and host-side verification matrix scripts
- Mise tasks: vm:build-custom-runtime, vm:verify, vm:check-capabilities
- Architecture and operator documentation
Drew Newberry