Stop the firewall and ACL suites rebuilding an image their caller supplied

Both suites ran `docker compose up -d --build` unconditionally, and their
compose files carry both a build context and an image name, so the flag
rebuilt and retagged the shared test image from the shared build context on
every run. Their --skip-build flag did not cover it: it guarded only the
Rust build above. Under a harness that has already built the image and
handed it over, that rebuild can only replace the binaries under test with
whatever the shared context currently holds.

The nat scripts had the mirror-image problem. Their image guard built a
replacement whenever the image was missing, which is right by hand and
wrong under a harness: when the caller names an image it built, a miss
means something upstream is broken, and manufacturing a substitute hides
that. They now fail loudly in that case and keep building only on the hand
path. The mesh-lab guard reads the same variable and its build hint moves
to the script that still produces the shared tag.

testing/firewall/test.sh

@@ -191,7 +191,15 @@ log "Generating firewall fixtures"
 
 log "Starting firewall harness"
 docker compose -f "$COMPOSE_FILE" down >/dev/null 2>&1 || true
-docker compose -f "$COMPOSE_FILE" up -d --build
+# --build only on the hand path. Under a harness, --skip-build means the caller
+# has already built the image this compose file names, and rebuilding it here
+# would overwrite that image from whatever the shared build context happens to
+# hold — which is how a suite ends up certifying binaries it was never given.
+if [ "$SKIP_BUILD" = false ]; then
+    docker compose -f "$COMPOSE_FILE" up -d --build
+else
+    docker compose -f "$COMPOSE_FILE" up -d
+fi
 
 log "Waiting for fips0 on both nodes"
 wait_for_fips0 "$CONTAINER_A" 40