Fix egress DNS deployment firewall

[arslnb]

Summary

• make the sandbox nftables table reload-safe with destroy table inet sandboxd
• allow sandbox bridge traffic to the controlled DNS proxy through UFW
• keep provisioning/install scripts aligned with the deployed network model

Validation

• bash -n deploy/install.sh deploy/provision-node.sh
• git diff --check
• cargo test -p sandboxd egress
• EX44: nft -c -f against the patched nftables file
• EX44: ufw --dry-run allow in on wdbr0 to 10.200.0.1 port 53 proto udp/tcp

Live smoke context

The first EX44 egress smoke run passed egress none, CIDR/port allowlists, and policy rejection, but domain policies timed out on DNS. Kernel logs showed UFW blocking sandbox bridge packets to the host DNS proxy, so this patch adds the missing controlled DNS ingress allow.