[Bug]: container k8s create fails when node preparation invokes iptables-nft

### I have done the following

- [x] I have searched the existing issues
- [x] I reproduced this with the current release

### Steps to reproduce

```bash
container system start
container k8s create --name sighup-local --cpus 6 --memory 16g
```

### Current behavior

Cluster creation fails after the node starts and `kubeadm init` begins:

```text
Preparing node: ["id": sighup-local]
[2/2] Running kubeadm init [3s]
Error: node prep failed on sighup-local: net.ipv4.ip_forward = 1
registry.k8s.io/pause:3.10.1
```

The failed node remains running. The plugin's node-preparation path uses `iptables-nft`, which cannot access the nftables ruleset in the default node kernel:

```bash
container exec sighup-local /usr/sbin/iptables-nft -t mangle -S
```

```text
iptables v1.8.11 (nf_tables): Could not fetch rule set generation id: Invalid argument
```

Within the node, `/usr/sbin/iptables` resolves to the nft backend; `/usr/sbin/iptables-legacy` is also present.

### Expected behavior

`container k8s create` should finish its node preparation and create a usable cluster. The plugin should either use the available legacy backend when nftables is unavailable or ensure that its default node kernel supports the nftables operations it invokes.

### Environment

```text
macOS 26.6.1 (25G76), arm64
container CLI version 1.2.2 (release, commit 0190097)
container-apiserver version 1.2.2 (release, commit 0190097)
```

### Related issue

[#1002](https://github.com/apple/container/issues/1002) documented the same `nf_tables` kernel limitation for Docker inside a container. That issue is closed and predates the Kubernetes plugin. This report covers the current `container k8s` node-preparation path.

Reproduce the failure with `container k8s create --name sighup-local --cpus 6 --memory 16g`, then trace the Kubernetes plugin's node-preparation path around `kubeadm init` and its `iptables-nft` invocation. Compare the available nft and legacy backends, using related issue #1002 for context. Done means node preparation completes and `container k8s create` produces a usable cluster.

Written by the indexing model from the issue text.