ci: rebuild test kernel with nftables built-in (#108)

Modern netavark defaults to the nftables firewall driver, but our
test kernel had CONFIG_NF_TABLES=m and the rootfs ships no modules,
so `nft` calls failed and podman containers couldn't start in the
QEMU integration test. Flip NF_TABLES, all NFT_*, NF_FLOW_TABLE*,
NF_TABLES_BRIDGE, NF_CONNTRACK_BRIDGE, NF_DUP_NETDEV and TUN to =y,
add `make olddefconfig` to prepare_kernel_image.sh so dependency
cascades resolve cleanly, and rebuild bzImage against v6.12.86 (the
6.12.18 we were on predates the libbpf const-qualifier fix needed
for glibc 2.41+ / GCC 14+ host toolchains).

Author: dottorblaster

testdata/bzImage

@@ -1387,39 +1387,39 @@ CONFIG_NF_NAT_REDIRECT=y
 CONFIG_NF_NAT_MASQUERADE=y
 CONFIG_NF_NAT_OVS=y
 CONFIG_NETFILTER_SYNPROXY=y
-CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=m
-CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=m
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_FLOW_OFFLOAD=y
 # CONFIG_NFT_CONNLIMIT is not set
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_TUNNEL=y
 # CONFIG_NFT_QUEUE is not set
-CONFIG_NFT_QUOTA=m
-CONFIG_NFT_REJECT=m
-CONFIG_NFT_REJECT_INET=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB=m
-CONFIG_NFT_FIB_INET=m
-CONFIG_NFT_XFRM=m
-CONFIG_NFT_SOCKET=m
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_HASH=y
+CONFIG_NFT_FIB=y
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_XFRM=y
+CONFIG_NFT_SOCKET=y
 # CONFIG_NFT_OSF is not set
-CONFIG_NFT_TPROXY=m
+CONFIG_NFT_TPROXY=y
 # CONFIG_NFT_SYNPROXY is not set
-CONFIG_NF_DUP_NETDEV=m
-CONFIG_NFT_DUP_NETDEV=m
-CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=m
-CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=m
-CONFIG_NF_FLOW_TABLE=m
+CONFIG_NF_DUP_NETDEV=y
+CONFIG_NFT_DUP_NETDEV=y
+CONFIG_NFT_FWD_NETDEV=y
+CONFIG_NFT_FIB_NETDEV=y
+CONFIG_NFT_REJECT_NETDEV=y
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NF_FLOW_TABLE_PROCFS=y
 CONFIG_NETFILTER_XTABLES=y
 # CONFIG_NETFILTER_XTABLES_COMPAT is not set
@@ -1588,9 +1588,9 @@ CONFIG_IP_NF_IPTABLES_LEGACY=y
 CONFIG_NF_SOCKET_IPV4=y
 CONFIG_NF_TPROXY_IPV4=y
 CONFIG_NF_TABLES_IPV4=y
-CONFIG_NFT_REJECT_IPV4=m
-CONFIG_NFT_DUP_IPV4=m
-CONFIG_NFT_FIB_IPV4=m
+CONFIG_NFT_REJECT_IPV4=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
 CONFIG_NF_TABLES_ARP=y
 CONFIG_NF_DUP_IPV4=y
 CONFIG_NF_LOG_ARP=m
@@ -1617,7 +1617,7 @@ CONFIG_IP_NF_TARGET_TTL=y
 CONFIG_IP_NF_RAW=y
 CONFIG_IP_NF_SECURITY=y
 CONFIG_IP_NF_ARPTABLES=m
-CONFIG_NFT_COMPAT_ARP=m
+CONFIG_NFT_COMPAT_ARP=y
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 # end of IP: Netfilter Configuration
@@ -1629,9 +1629,9 @@ CONFIG_IP6_NF_IPTABLES_LEGACY=y
 CONFIG_NF_SOCKET_IPV6=y
 CONFIG_NF_TPROXY_IPV6=y
 CONFIG_NF_TABLES_IPV6=y
-CONFIG_NFT_REJECT_IPV6=m
-CONFIG_NFT_DUP_IPV6=m
-CONFIG_NFT_FIB_IPV6=m
+CONFIG_NFT_REJECT_IPV6=y
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_NF_DUP_IPV6=y
 CONFIG_NF_REJECT_IPV6=y
 CONFIG_NF_LOG_IPV6=m
@@ -1659,10 +1659,10 @@ CONFIG_IP6_NF_TARGET_NPT=m
 # end of IPv6: Netfilter Configuration
 
 CONFIG_NF_DEFRAG_IPV6=y
-CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NF_TABLES_BRIDGE=y
 # CONFIG_NFT_BRIDGE_META is not set
-CONFIG_NFT_BRIDGE_REJECT=m
-CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_NFT_BRIDGE_REJECT=y
+CONFIG_NF_CONNTRACK_BRIDGE=y
 CONFIG_BRIDGE_NF_EBTABLES_LEGACY=m
 CONFIG_BRIDGE_NF_EBTABLES=m
 CONFIG_BRIDGE_EBT_BROUTE=m
@@ -2566,7 +2566,7 @@ CONFIG_NETCONSOLE=y
 # CONFIG_NETCONSOLE_EXTENDED_LOG is not set
 CONFIG_NETPOLL=y
 CONFIG_NET_POLL_CONTROLLER=y
-CONFIG_TUN=m
+CONFIG_TUN=y
 CONFIG_TAP=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 CONFIG_VETH=y

testdata/config

@@ -16,6 +16,7 @@ git clone --depth 1 --branch "$kernel_version" git://git.kernel.org/pub/scm/linu
 echo "Configuring kernel"
 cd kernel_source
 cp ../config .config
+make olddefconfig
 
 echo "Building kernel"
 make -j$(nproc) bzImage