> Yet systemd doesn't have an equivalent to runit's sv once.

It's a design difference - systemd assumes services know whether they are intended to run once or restart under various conditions. If you want that behaviour it's just a matter of a tweak to the .service file.

> Also, everything's so opaque that I can't figure out why nftables ruleset isn't loaded on boot

Has it been disabled? ("systemctl enable [service name]" will enable it)