HardenIsolation unconditionally applied the NIC isolation options
(security.port_isolation / ipv4_filtering / ipv6_filtering) to eth0.
Incus only accepts those options on bridged NICs — pool-mode eth0 is a
routed NIC carrying the public /128, so `vps install` failed with
"Invalid device option security.ipv4_filtering". Prefix mode (single
bridged eth0) was unaffected, which is why the bug only surfaced in
pool mode.
- EnsureEth0Options generalized to EnsureDeviceOptions(name, devName)
(wrapper kept for the EnsureBlockRoutes caller)
- HardenIsolation now iterates all NICs and skips non-bridged ones;
pool-mode eth1 (bridged) is hardened like a prefix-mode eth0
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
