feat(runtime): serialize nftables policy through one typed transaction owner

[forkwright]

Finding

Phase 06 aspis containment and Phase 08 lethe protected-route policy are
different intents over one host-global nftables ruleset. Independent writers
would race on locking, snapshots, reconciliation, status, and rollback, and a
partial update could weaken either security boundary.

Desired correction

Give the Akroasis application one typed nftables transaction backend. Aspis
submits containment intents and lethe submits protected-route intents through
that owner; neither domain writes nftables directly.

Done when

1. One application-owned backend exclusively owns nftables locking, current-
   state observation, intent composition, atomic apply, reconciliation,
   status, and rollback.
2. Aspis containment and lethe protected-route requests use distinct typed
   intents and disjoint owned tables/chains. Conflicts are rejected before
   mutation; neither consumer can address or weaken the other's rules.
3. The backend composes all accepted intents into one validated transaction.
   Apply either commits the complete intended state or restores the last
   verified state; restart reconciliation cannot silently accept a partial or
   foreign ruleset.
4. Consumer APIs expose intent and status only. Static and runtime tests prove
   there is no direct aspis/lethe command or library path that mutates nftables
   outside the backend.
5. Deterministic mock or isolated-network-namespace tests cover simultaneous
   intents, conflict, malformed state, partial failure, cancellation, restart,
   rollback, and status. Protected-route failure remains fail closed and
   containment failure never broadens access.
6. Any real host-network mutation remains a separately authorized operation;
   software acceptance does not require changing the operator's live ruleset.

Relationships

• Phase 06 owns aspis containment policy and response authorization.
• Phase 08 owns lethe protected-route policy and the praxis automation stop.
• This issue owns only their shared host-global transaction mechanism.