R002 fix: netstack/src/filter/conntrack.rs captured '(is_orig, entry_key)'
in an if/else, but the 'if let' arm early-returned, so is_orig was
always true. Reply-direction state machine was unreachable for
already-established flows. Flattened the conditional: reply-side
'if let' early-returns; fall-through uses original key directly.
The is_orig variable is gone; orig-side path calls
advance_entry_state with is_orig=true explicitly.
vasilito
3f9643be97