- Add POSTROUTING MASQUERADE rule alongside DNAT rules to ensure return
traffic from container targets can route back through the same interface,
matching legacy shell script behavior
- Enhance FileWatcher to trigger periodic state reconciliation every tick
regardless of config file changes, ensuring desired state is maintained
after container restarts or iptables flushes
