0.2.6

• Docker sets the host's iptables FORWARD policy to DROP and accepts only its
  own bridges, so LXD containers lose IPv4 entirely. It never touches
  ip6tables, so containers still reach anything with an AAAA record: apt,
  NodeSource, npm and Google's CDN all succeed and the build dies four stages
  in on github.com, the first IPv4-only host it needs, as a bare connection
  timeout. Every host with Docker installed hits this, including every
  Hostinger VPS, whose management agent runs under Docker.
• infra/lib/container-forwarding.sh detects a restricted FORWARD chain and
  idempotently allows the LXD bridge through DOCKER-USER — the chain Docker
  documents as user-owned and evaluates first — falling back to FORWARD when
  Docker is absent. Docker's isolation of its own bridges is untouched.
• The same library is the ExecStart of futrx-lxd-forward.service, so the rules
  are defined once and re-applied on every boot: iptables state is not
  persistent and Docker reinstates its policy on each start. The unit is
  installed unconditionally and self-gates, so a host that later installs
  Docker is covered too.
• The base-image build now probes IPv4 egress from the builder before running
  any stage and fails immediately naming the cause and the fix, instead of
  spending nine minutes to report a misleading GitHub timeout.
• Hermetic coverage in infra/tests/container-forwarding-test.sh (wired into
  CI) and a builder test asserting the build stops before any install stage.