network extension: peding apple dev. license

[adamsiwiec1]

Summary

• Isolates the LuLu-style Network Extension (hold-and-drop, default drop) so it does not block other work.
• pf / TUN stay the fail-closed lock. Apple-hidden or fail-open flows mark the session Degraded, not Protected.
• Do not merge until we have an Apple Developer Program membership and decide which company it is enrolled under. The filter will not load on unsigned or ad-hoc Debug builds. Shipping it needs a Developer ID network-extension profile, the host-app entitlements in scripts/macos-pkg/OnionGate.entitlements, and user approval in System Settings → Network Extensions.

Status / blockers

• Waiting on Apple Developer Program approval, or a decision to enroll and which legal entity (company) the account sits under.
• Until that lands, unsigned builds stay on pf and the after-the-fact socket watch. That is expected.

Test plan

• cargo test --offline --lib ne_filter (classify + protect_gate)
• Unsigned / ad-hoc Debug: Connect still works; filter reports not bundled; session is not Degraded for a missing filter
• After a signed build exists: approve the extension in System Settings, confirm heartbeat, confirm a non-Tor flow is dropped and the session Degrades on unseen bypass
• Confirm Allow does not punch clearnet (there is no such action)