coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers

Reuses existing fixtures (CommandRunner fakes, SQLite tempfile store,
pure-Go seams). No new infra needed.

  hostnat                  50% -> 98%   (iptables orchestration via fake runner)
  store                    78% -> 91%   (guest_sessions CRUD roundtrip)
  daemon/session           57% -> 95%   (script gen, state parse, snapshot apply)
  daemon/opstate           67% -> 100%  (Registry Insert/Get/Prune)
  daemon (firstNonEmpty)   slight bump

Total 54.0% -> 56.5%.

internal/daemon/images_helpers_test.go

@@ -0,0 +1,24 @@
+package daemon
+
+import "testing"
+
+func TestFirstNonEmpty(t *testing.T) {
+	cases := []struct {
+		name   string
+		values []string
+		want   string
+	}{
+		{"all empty", []string{"", "   ", "\t"}, ""},
+		{"first wins", []string{"a", "b"}, "a"},
+		{"skips blanks", []string{"", "  ", "first", "second"}, "first"},
+		{"nil input", nil, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := firstNonEmpty(tc.values...)
+			if got != tc.want {
+				t.Errorf("firstNonEmpty(%v) = %q, want %q", tc.values, got, tc.want)
+			}
+		})
+	}
+}