fix(mkosi): enable Docker IPv4 NAT modules

[kvinwang]

Problem

Docker bridge networking requires the kernel IPv4 NAT/netfilter modules, but the mkosi kernel configuration omitted them. Containers could start but outbound masquerading/port forwarding failed because the required tables and targets were unavailable.

Root cause and fix

Enable the IPv4 NAT and related netfilter modules used by Docker in the guest kernel configuration.

Implementation

The branch records the following focused implementation work:

• fix(os/mkosi): enable Docker IPv4 NAT modules
• fix(os/mkosi): use current xtables NAT symbols

Changed paths:

• os/mkosi/components/kernel/kernel.config

Scope

This PR addresses one logical mkosi finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

This PR is based directly on master and does not require another split product PR to merge first.

Verification

• git diff --check origin/master..origin/codex/fix-mkosi-docker-ipv4-nat: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.