say how the nftables rules are put in place, and fix the quoting of the heads

say how the nftables rules are put in place, and fix the quoting of the heads

Two things about the nftables file that nothing said, both found by looking
inside the debian package:

  - nftables.service runs with ProtectHome=true, so it reads nothing under
    /home: the file cannot be included where it is written and has to be
    copied out of Etc. It was being copied anyway, but for no stated reason.

  - /etc/nftables.d is not a directory of the nftables package, which ships
    /etc/nftables.conf alone: it exists only because of the include, so it
    has to be created and the include added once. And /etc/nftables.conf
    begins with "flush ruleset", so loading it replaces whatever is active,
    and the include has to come after that line.

The commands now say all of it, both in the head of the generated file and
in the list the action prints, and they load /etc/nftables.conf rather than
the single file, which is what the service does at boot.

Also: the heads of the generated files had "run "INSTALL.sh system" again"
written inside an echo "...", so the shell ate the inner quotes.

Checked in the container: the action prints the four steps, and the head of
the generated file carries them with its quotes intact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>