fix(docker): probe the daemon kernel for egress control regardless of client platform
Fixes the second half of #2527.
and (sys.platform == "linux" or self._egress_control_kernel_support())
The probe runs docker container run, so it measures the daemon's kernel. sys.platform is the client. When they differ — Harbor in a container against a mounted docker.sock, a remote DOCKER_HOST — the or skips the probe and we accept a policy the kernel can't enforce, then the sidecar dies with dependency failed to start and no stderr.
Dropping the sys.platform half means unsupported daemons get the capability model's clear rejection instead. The probe is cached and only runs for restricted policies, so public is unaffected.
Three unit tests were pinning the old behavior; they're now parametrized over linux/darwin/win32. The runtime network-policy tests had the same mix-up in their skipif and now check the probe instead of the platform.
One thing to flag: the probe returns False when it can't run at all, not just when the kernel lacks the symbol. So an air-gapped host that can't pull the probe image would now be rejected where it used to work. Happy to separate "unsupported" from "couldn't probe" if you'd rather not take that.
This doesn't make allowlist work on Docker Desktop — the fib rule question is untouched.
