fix: shared-netns infra containers must not run their own firewall

nix/host-modules/hive-forge/default.nix

@@ -327,6 +327,14 @@ in
         in
         {
           system.stateVersion = "25.11";
+
+          # Shared host netns: this container's own firewall.service
+          # would rewrite the HOST ruleset (flush nixos-fw, drop the
+          # host's nixos-nat-* chains) at every boot — killing the
+          # bridge DHCP/DNS holes and agent NAT. The host firewall owns
+          # all filtering; never run one in here.
+          networking.firewall.enable = false;
+
           services.forgejo = {
             enable = true;
             package = cfg.package;