test(netgw): the suite fails when repeated in one process #118

While looking at the two netgw flakes fixed in #116, I ran the package repeatedly in one process and it does not survive that:

go test -count=3 -race ./internal/netgw/
--- FAIL: TestEgressCIDRCarriesRealBytes
--- FAIL: TestEgressHostGlobCarriesRealBytesAfterResolving
--- FAIL: TestEgressRefreshedHostCarriesRealBytes
    egress_e2e_test.go:221: timed out waiting for a SYN-ACK or a reset

Same on unmodified main, so it is not something #116 introduced. Each of the three passes alone at -count=5 -race, and CI runs the suite once, so nothing fails there today.

Details

The tests never close the networks they create: there is no Network.Close in the package, so every test leaves its netstack, DNS and DHCP goroutines and gonet listeners running until the process ends. By the second or third repetition the egress tests that push real bytes through the gateway stop getting their SYN-ACK in time. #116 adds one more way to accumulate a leaked network, in startupNetworkFresh, when a drawn port turns out to be taken.

Presumably the fix is a Close on Network that tears the stack and its goroutines down, with the test helpers calling it from t.Cleanup. That would also make the package's -count=N runs usable for chasing the next flake.

Not urgent -- CI does not hit it -- but worth doing before the next time somebody needs to repeat this suite to reproduce something.

Refs: #116