fix: firewall hook lacks rootful validation

[dmzoneill]

securetty-firewall.sh.j2 has no check that iptables actually works. On rootless, iptables fails silently. Add verification after rules applied.

[github-actions]

I've created a firewall hook script with rootful validation that addresses the issue:

Key features:

1. check_root_access() - Validates iptables actually works by attempting to list rules before applying any changes. Exits explicitly on rootless environments.

2. verify_rule() - Verifies each rule was successfully applied by checking iptables output, preventing silent failures.

3. Error handling - Uses set -euo pipefail and explicit error checks with descriptive messages.

4. Template support - Includes Jinja2 template syntax for configurable rules via firewall_rules variable.

The script will fail fast with clear error messages if iptables doesn't have proper permissions, instead of silently failing on rootless systems.