openthread-br: update to the 2026.09.0 release

[LorbusChris]

Update openthread-br from the 2026-05-22 snapshot to the v2026.09.0 release, and switch
the firewall to the new in-process nftables backend. Mirrors openwrt/packages#30427 for
this copy of the packaging (without the extra patch additions from #53 — the carried
patch set stays exactly what main has, refreshed on the new base).

Update commit:

• The openthread-br-luci package is gone: upstream removed the in-tree LuCI app in this
  release ([openwrt] remove the in-tree LuCI app (proposed for openwrt/luci) openthread/ot-br-posix#3326); a maintained replacement is proposed as a
  proper LuCI app in luci-app-openthread: add new application openwrt/luci#8871 / luci-proto-openthread: add protocol support for the border router openwrt/luci#8942.
• The openthread-br-avahi variant is gone too: this release removed the avahi mDNS
  backend outright (OTBR_MDNS=avahi is now a configure error; only mDNSResponder and
  the OT-internal mDNS remain), so the variant machinery goes and the package always
  builds against mDNSResponder.
• Carried patches refreshed: 020 regenerates around the reworked options.cmake (its
  context line is now the OTBR_NFTABLES conditional), the ubus series 100–110
  regenerates on top of the memory-safety fixes merged upstream out of it
  ([ubus] fix two memory-safety issues openthread/ot-br-posix#3487); 030/040/050 apply unchanged. The full sequence applies
  without fuzz.
• -DOTBR_SRP_ADVERTISING_PROXY=ON is dropped: since this release the OT core
  advertising proxy defaults on whenever an mDNS backend is selected, and forcing the
  otbr-side proxy alongside it is a CMake FATAL_ERROR. The advertising proxy function
  moves to the OT core implementation, which is the upstream default.
• The new vendor/product-name requirement is already met here: OTBR_VENDOR_NAME is
  compiled in and the init script has always passed --model-name from board.json.

nftables commit:

• The package has never had a Thread firewall (OT_FIREWALL produces ipset/ip6tables
  rules, disabled pending nftables support openthread/ot-br-posix#1675). This release delivers that
  issue: OTBR_NFTABLES=ON has otbr-agent install the Thread ingress filter and NAT44
  masquerade in-process, through nftables in an isolated table.
• Adds kmod-nft-core/kmod-nft-nat (runtime nf_tables support — with the backend
  compiled in, a failed firewall install aborts the agent by design) plus
  libmnl/libnftnl.
• Ships the /usr/share/otbr/nftables-backend marker the build writes (a debugging
  aid; nothing on the target reads it today).

PKG_MIRROR_HASH generated end-to-end by the git-with-metadata download in the OpenWrt
CI SDK image (x86_64 snapshot) and hash-check verified; compile test in the same SDK.

Written with AI assistance (Assisted-by trailers); I've reviewed and understand all of
it and will answer questions myself.