LXC unrestricted state-aware restart leaves a previous run's firewall chain in place

[dhoehna]

src/backends/lxc/common/src/state_aware.rs does not remove an existing firewall chain when a restart carries no network policy.

[github-actions]

Triage result:

• Labels applied: OS-Linux, Area-Executor-LXC
• Assigned: @SohamDas2021 (LXC / iptables), @bbonaby (networking / firewall / iptables)

The bug is in the LXC state-aware restart path: when a container restarts with no network restrictions, apply_firewall_rules returns success without removing a previously-installed restrictive iptables chain (network_iptables.rs:1221-1229), leaving reported and enforced policy out of sync.

Maintainers: Comment /investigate to check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.

Generated by 🏷️ Issue Triage for #889 · sonnet46 · 18.8 AIC · ⌖ 5.34 AIC · ⊞ 7.4K · ◷

[dhoehna]

Consolidated into #898 -- [LXC] Firewall teardown and rollback report success while leaving state behind.

The backlog now carries one issue per area instead of one per finding. This report is reproduced there in full and unedited; nothing here is dropped. Track and fix it at #898.