fix: reconcile egress drop rules to the desired set

[CMGS]

Problem

cocoon-net v0.1.6 added --drop-internal-access / --drop-cidr egress DROP rules, but setupIPTables only adds them. Changing the drop set (e.g. removing a --drop-cidr, or moving the subnet) or clearing it left the old cocoon-net-drop-tagged FORWARD rules in place until an explicit cocoon-net teardown — stale isolation rules that can over-block.

Change

• setupIPTables now reconciles to the desired drop set on every run: insert the desired rules first (idempotent via iptInsert's Exists check), then reconcileDropRules prunes any tagged FORWARD drop rule whose -d destination is no longer wanted.
• Insert-then-prune keeps the reconcile gapless — no window where VM-to-VM isolation is off on daemon restart. (The old code never removed on restart, so this preserves the no-gap property while adding convergence on config change.)
• ClearDropRules is now a thin wrapper over reconcileDropRules(ctx, ipt, nil) (empty set ⇒ remove all) — one source of truth for the list/match/delete logic.
• New pure helper ruleDest(fields) extracts the -d <cidr> from an iptables -S line, with a table-driven test.

Verification

• make lint 0 issues (GOOS=linux + darwin); make test green.
• TestRuleDest cross-compiled and run on a real linux host — all cases pass.

🤖 Generated with Claude Code