Publish an atomic software run-state snapshot through iflib_is_running().
Use it for iflib traffic admission, queue tasks, timers, debugnet and
live-configuration checks instead of reading the unsynchronized
ifnet driver flags.  Keep admission closed after failed initialization
and close it when a watchdog requests deferred recovery.

Retain the context-locked datapath state for DMA ownership: a closed
admission gate does not establish that the hardware is stopped.  Open
the gate after receive-buffer setup and before interrupt enable, at the
existing RUNNING publication point.  Serialize the writers with the
state mutex and continue publishing RUNNING/OACTIVE for network-stack
consumers.  The accessor takes no lock and is usable from filters, but
is only a snapshot, not a context reference or a queue-user drain.

Recheck multicast and VFLR admission under the context lock.  Replace
the OACTIVE drain check with the same private admission gate, retaining
the separate per-queue descriptor backpressure policy.  Rename its
debug counter to txq_drain_stopped.

Document the accessor and its synchronization limits.  This does not
remove legacy flag reads elsewhere in the network stack or change the
existing queue-drain and device-stop contracts.