refactor(bootstrap_firewall/linux): split three pure seams out of the probe path

FOLD-1 riders, doyle's dispatch from hertz's Linux seam survey (releases#304 W2).
linux.rs carries 676 lines of admission logic and zero cells; nothing here adds a
cell — these are the seams that make cells possible, and hertz writes them on
kitsubito.

  backend_from(ufw, firewalld, nft_present) — the backend PRECEDENCE, decided
  over already-read probe results. The order is the policy: an active manager
  outranks the backend it writes into, and nft is the fallback rather than a
  peer, because writing a competing nft base chain beside an active manager is
  how two rulesets start disagreeing about one port.

  parse_ufw_rules(&str) — the `ufw status numbered` parser, split from the
  command call. Every shape it refuses (inactive listing, missing bracketed
  number, unparsable number) is now reachable from a string literal instead of
  from a host arranged into that state.

  ufw_preflight(&[UfwRule], port) — the adoption guards over rules ALREADY READ.
  The dangerous cases (an unowned rule already allowing this port, a foreign
  ownership comment) become fixture data rather than a live-host arrangement.

PROBE LAZINESS IS PRESERVED EXACTLY, and that is not incidental: the original
chain never consulted firewalld once UFW answered and never looked for nft once
either manager did. `backend()` keeps that short-circuit rather than evaluating
three probes eagerly and calling it the same verdict — running probes the old
code deliberately skipped would be a behaviour change smuggled in as a refactor.
The five other `ufw_rules()` call sites are untouched.

NOT COMPILED BY THIS LANE'S GATE. `linux.rs` is `cfg(target_os = "linux")` and
only `x86_64-pc-windows-msvc` is installed on this box, so the compile-gate here
proves the Windows build still links and NOTHING about these bytes. That is the
same cfg-invisibility that left this file's 676 lines uncovered in the first
place, and it is stated rather than implied: the Linux compile belongs to
kitsubito.

releases#304 releases#297

Co-authored by: todlando

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8rmw2TwXUSA88iFjYV3ii