host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match

host_firewall/files/nft-host-spamhaus

@@ -102,10 +102,6 @@ def merge(family, *groups):
     return list(ipaddress.collapse_addresses(networks)), skipped
 
 
-def nft(*args):
-    return subprocess.run(["nft", *args], capture_output=True, text=True)
-
-
 def main():
     with tempfile.TemporaryDirectory() as tmp:
         drop4 = [r["cidr"] for r in spamhaus_records("drop_v4", tmp)]
@@ -134,7 +130,11 @@ def main():
         candidate = os.path.join(tmp, "host-spamhaus.nft")
         with open(candidate, "w", encoding="utf-8") as f:
             f.write("\n".join(persisted))
-        checked = nft("-c", "-f", candidate)
+        # Checked under another table name: a dry run against the live table
+        # name changes the live sets for its duration and unlisted addresses match.
+        with open(candidate, encoding="utf-8") as f:
+            check_rules = f.read().replace("table inet host {", "table inet host_spamhaus_check {")
+        checked = subprocess.run(["nft", "-c", "-f", "-"], input=check_rules, capture_output=True, text=True)
         if checked.returncode != 0:
             fail(f"nft rejects the sets: {checked.stderr.strip()}")