fix: skip firewalld port config when firewalld is not running

[Copilot]

On openEuler, firewalld is installed by default but not started. NewFirewallClient() was selecting firewalld purely based on binary presence (cmd.Which), causing any subsequent firewall-cmd invocation to trigger D-Bus socket activation — starting firewalld and applying port rules without user intent.

Changes

• agent/utils/firewall/client.go: In NewFirewallClient(), after detecting the firewalld binary, check if the service is actually running via controller.CheckActive("firewalld") before returning a firewalld client. If not active, fall through to iptables. Check errors are logged at debug level.

// Before: binary presence alone selected firewalld
if firewalld {
    return client.NewFirewalld()
}

// After: also verify the service is running
if firewalld {
    isActive, err := controller.CheckActive("firewalld")
    if err != nil {
        global.LOG.Debugf("failed to check firewalld active status: %v", err)
    }
    if isActive {
        return client.NewFirewalld()
    }
}

This aligns the agent with the existing behavior in core/utils/firewall/firewall.go, which already gates firewall-cmd calls behind a running-state check.