fix: skip nftables cleanup when auto redirect was never started

[sparkfade]

Summary

• autoRedirect.Close() unconditionally deleted the inet sing-box nftables table, even for instances that never entered Start() and therefore never created it. Closing such an instance silently removes the table that is still managed by the running instance.
• This is easy to hit: sing-box tools fetch (and the other tools subcommands) builds the box with box.New() + PreStart() and closes it on exit, so running a diagnostic tool against a config with auto_redirect breaks transparent proxying for the whole LAN until the service is restarted. (Observed on Linux with sing-box 1.14.2: the table disappears immediately after the command exits.)
• The instance now marks the table as owned right before it deletes/recreates it in Start(), so failed setups are still cleaned up, and Close() only cleans up when it was marked. This mirrors the iptables backend, where cleanup only runs when the paths were configured during Start().

Test plan

• netns: an instance started with tun + auto_redirect creates the table; a second instance that only runs PreStart/Close no longer deletes it
• normal start/stop still creates and deletes the table
• Start() failure after taking over the table still cleans up the partial table

[sparkfade]

@nekohasekai plz take a look at this thank u