Docker 29.8+ breaks Swarm containers reaching their own node's ports under ufw

On Docker 29.8.0 and later, a container on a Swarm overlay network times out when connecting to an ingress-published port on the same node with ufw set to deny incoming. The connection now passes through the host's INPUT chain and docker-proxy instead of being DNATed; the same test passed on 29.7.2.

• Reproduced on Docker CE 29.9.1; the same probe succeeds on 29.7.2
• ufw drops the SYN arriving from docker_gwbridge, logged as [UFW BLOCK]
• Workaround: ufw allow in on docker_gwbridge to any port 8080 proto tcp
• Disabling userland-proxy or ufw also fixes the timeout