feat: complete nftables fallback and add eBPF build tooling

## nftables Fallback (Blocker #2 - FIXED)
- Add NftablesManager struct with full API:
  - apply(): Actually applies rules to kernel (was check-only before)
  - block_ip(): Runtime IP blocking
  - allow_tcp_port()/allow_udp_port(): Dynamic port management
  - cleanup(): Remove yacht firewall table
- Add Firewall enum to unify eBPF and nftables management
- Fix critical bug: rules were validated but never applied (used -c flag)

## eBPF Build Tooling (Blocker #1 - Build Infrastructure)
- Add xtask crate for workspace-level build tasks
- Add cargo xtask commands:
  - build-ebpf: Compile XDP firewall with nightly toolchain
  - install-ebpf: Install to /etc/wharf/
  - build-all: Build everything
- Add .cargo/config.toml with xtask alias
- Update workspace to include xtask, exclude fuzz/

The eBPF kernel code was already complete - this adds the build automation
to compile it with: cargo xtask build-ebpf

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.cargo/config.toml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+
+# Cargo configuration for Project Wharf
+
+[alias]
+# Run xtask commands (e.g., cargo xtask build-ebpf)
+xtask = "run --package xtask --"
+
+# Build everything including eBPF
+build-all = "xtask build-all"
+
+# eBPF-specific target configuration
+[target.bpfel-unknown-none]
+rustflags = ["-C", "link-arg=--btf"]

Cargo.lock

@@ -3,10 +3,12 @@ members = [
     "crates/wharf-core",
     "bin/wharf-cli",
     "bin/yacht-agent",
+    "xtask",
 ]
 # eBPF crate excluded from default build - requires special toolchain (bpf-linker)
-# Build separately with: cd crates/wharf-ebpf && cargo +nightly build --target bpfel-unknown-none
-exclude = ["crates/wharf-ebpf"]
+# Build with: cargo xtask build-ebpf
+# Or manually: cd crates/wharf-ebpf && cargo +nightly build --target bpfel-unknown-none -Z build-std=core
+exclude = ["crates/wharf-ebpf", "fuzz"]
 resolver = "2"
 
 [workspace.package]