Add enforcement verification, zombie-tunnel detection, single-instance guard, exit-IP observation

[Behnam-RK]

Summary

Adopts four ideas from comparing dezhban against ClaudeVpnGuardian, a similar Windows-only kill-switch project — closing gaps dezhban had, without adopting anything that would weaken its stronger default-deny/enforce-at-rest model.

• Enforcement verification (vpn.advanced.verifyInterval, default 1m) — the run loop periodically confirms Backend.IsBlocked() still says the rules are installed, and re-applies the standing posture the instant they are not. Previously, nothing ever noticed a ruleset removed from outside the daemon (another firewall tool, pfctl -F all, nft flush ruleset, an OS reset) — the daemon kept reporting GUARD while the host was open. An unreadable backend is never treated as evidence the rules are gone, mirroring the "undeterminable country HOLDS" discipline.
• Zombie-tunnel detection — a tunnel interface that reports up while a run of exit-country lookups through it fails is now diagnosed (state.zombie, dezhban doctor, the rendered posture sentence), always on. Acting on it — opening an automatic redial window — is a separate, off-by-default key (vpn.advanced.livenessRedial), because an exit that censors the geo providers produces the identical symptom on a tunnel that was never actually down. Full trade-off and alternatives in ADR-0010.
• Single-instance guard — run now takes an exclusive lock over the state directory for its whole lifetime (flock on Unix, a named mutex on Windows), so a second dezhban run (with or without --no-daemon) can't race an already-running daemon to call Backend.Apply. Released by the OS on process exit by any means, so a killed daemon never wedges the next start. panic/unblock/service-lifecycle commands deliberately take no such lock — they stay the escape hatch.
• Exit-IP change observation (state.exitIpChangedAt) — purely informational, logged and published when the exit IP differs from the previous successful reading; never touches blocked, countryCode, or the hysteresis streak.
• Startup self-test log line — one Info line at daemon start: firewall backend reachable, state dir writable, tunnels configured/detected, endpoints known, whether this host has ever observed a tunnel up.

Deliberately not adopted from the comparison: CVG's DNS-guard/IPv6-disable (dezhban already blocks both at layer 3 with no persistent OS mutation to restore), its backup-bundle system (only needed because it does mutate OS state), per-check blocking policy profiles (would recreate the à-la-carte security ADR-0001 removed), and killing the protected app (a second enforcement model).

Test plan

• go build ./..., go vet ./..., go test ./... — clean on macOS
• GOOS=windows GOARCH=amd64 and GOOS=linux GOARCH=amd64 build + vet — clean
• go test -race ./... — clean
• New unit tests: internal/runner/verify_test.go, liveness_test.go, exitip_test.go, cmd/dezhban/lock_unix_test.go
• Every config-schema/reload/roundtrip exhaustiveness test updated for the two new keys
• Ruleset rendering is byte-identical before/after — no internal/firewall/*.go touched
• On-host privileged checks per docs/contribute/testing.md (flush ruleset by hand and confirm repair; black-hole a tunnel's traffic and confirm zombie diagnosis with no window by default; second run refuses) — not run in this environment, flagged for manual verification before merge

🤖 Generated with Claude Code