Assert nftables firewall baseline postinst state in deb-install matrix

Extend testing/deb-install/test.sh per-distro container test loop with
5 new PASS assertions covering the v0.3.0 nftables firewall baseline
that ships installed-but-disabled (operator opt-in):

1. fips-firewall.service unit present at /lib/systemd/system/
2. fips-firewall.service disabled by default (is-enabled = 'disabled')
3. /etc/fips/fips.nft exists AND is registered as a dpkg conffile
4. /etc/fips/fips.d/ drop-in directory present with mode 755 root:root
5. fips.nft includes the drop-in glob /etc/fips/fips.d/*.nft

Assertions slot in between the existing fips-dns service-state check
and the simulated-boot service-start block. Each runs against every
distro in the existing matrix (debian12 / ubuntu24 / ubuntu26).

The security claim — services on fips0 are not exposed by default —
remains end-to-end-validated separately by the testing/firewall/
suite. This commit specifically pins the static install state so
packaging regressions surface in the per-push deb-install gate
rather than at operator opt-in time.

testing/deb-install/test.sh

@@ -279,6 +279,48 @@ DOCKERFILE
         fail "fips-dns.service not enabled after install"
     fi
 
+    # ── nftables firewall baseline (v0.3.0) ──────────────────────────
+    # The fips-firewall.service unit ships installed but DISABLED by
+    # default; operators opt in explicitly. The fips.nft ruleset is a
+    # dpkg conffile, and /etc/fips/fips.d/ is a drop-in directory the
+    # ruleset includes via a glob. None of these are exercised by the
+    # service-start path below — verify them as static install state.
+    if docker exec "$name" test -f /lib/systemd/system/fips-firewall.service; then
+        pass "fips-firewall.service unit installed at /lib/systemd/system/"
+    else
+        fail "fips-firewall.service unit missing from /lib/systemd/system/"
+    fi
+    # is-enabled prints 'disabled' (and exits non-zero) for an
+    # installed-but-not-enabled unit; capture stdout, don't gate on rc.
+    fw_state=$(docker exec "$name" systemctl is-enabled fips-firewall.service 2>/dev/null || true)
+    if [ "$fw_state" = "disabled" ]; then
+        pass "fips-firewall.service disabled by default (opt-in)"
+    else
+        fail "fips-firewall.service unexpected state: '$fw_state' (expected 'disabled')"
+    fi
+    if docker exec "$name" test -f /etc/fips/fips.nft && \
+       docker exec "$name" dpkg-query -W -f='${Conffiles}\n' fips 2>/dev/null \
+            | grep -q '/etc/fips/fips.nft'; then
+        pass "/etc/fips/fips.nft installed and registered as dpkg conffile"
+    else
+        fail "/etc/fips/fips.nft missing or not a registered conffile"
+    fi
+    if docker exec "$name" test -d /etc/fips/fips.d; then
+        fwd_mode=$(docker exec "$name" stat -c '%a %U:%G' /etc/fips/fips.d 2>/dev/null)
+        if [ "$fwd_mode" = "755 root:root" ]; then
+            pass "/etc/fips/fips.d/ drop-in dir present (755 root:root)"
+        else
+            fail "/etc/fips/fips.d/ wrong mode/owner: '$fwd_mode' (expected '755 root:root')"
+        fi
+    else
+        fail "/etc/fips/fips.d/ drop-in directory missing"
+    fi
+    if docker exec "$name" grep -qF 'include "/etc/fips/fips.d/*.nft"' /etc/fips/fips.nft; then
+        pass "fips.nft includes drop-in glob /etc/fips/fips.d/*.nft"
+    else
+        fail "fips.nft missing drop-in include for /etc/fips/fips.d/*.nft"
+    fi
+
     # Start the services as a simulated boot. (On a real system,
     # they'd come up on next reboot.)
     docker exec "$name" systemctl start fips.service 2>&1 || true