fix(network-go): handle reconnection gracefully and fix DNAT rule issues

- Ignore "endpoint already exists" error in ConnectContainer on re-reconciliation
- Improve iptables comment generation to avoid trailing dashes
- Enhance DNAT rule logic: try multiple selectors and fall back to host rules
- Add missing "-t nat" flag in InsertPreroutingRuleOnInterface

network-go/iptables/iptables.go

@@ -236,7 +236,7 @@ func (m *Manager) InsertPreroutingRule(sourceIP, proto, sourcePort, targetIP, ta
 // InsertPreroutingRuleOnInterface inserts a DNAT PREROUTING rule on a specific interface
 func (m *Manager) InsertPreroutingRuleOnInterface(iface, proto, sourcePort, targetIP, targetPort, comment string) error {
 	args := []string{
-		"-w", "-I", "PREROUTING",
+		"-w", "-t", "nat", "-I", "PREROUTING",
 		"-i", iface,
 		"-p", proto,
 		"--dport", sourcePort,