Add tomswall agent (control-plane pull mode)

Add `tomswall agent`: it pulls this device's compiled config from tomswallapi,
differentially applies it, and reports the applied generation. It caches the
last known-good config and, when the control plane is unreachable, keeps
applying that cache — it never fails closed.

- internal/agent: rendered-config types, HTTP client (fetch + status report),
  on-disk cache, on-device DNS resolver for dns sets (honors the device's
  configured resolver, fail-safe on lookup failure), and the pull-apply-report
  loop behind a mockable Applier.
- Translate the interface-agnostic, address-matched rendered model into native
  tomswall config using the "all:<cidr>" any-interface source/dest form, reusing
  the existing differential engine. Named-set members are inlined as concrete
  addresses (native nft set references are a tracked follow-up).
- cmd/tomswall: wire the `agent` subcommand (flags + TOMSWALL_* env, --once).
- Unit tests: translation, cache, and the don't-fail-closed fallback loop.
- Add DESIGN.md documenting the control-plane architecture.

internal/agent/cache.go

@@ -0,0 +1,36 @@
+package agent
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// Cache persists the last known-good rendered config to disk so the agent can
+// keep applying it when the control plane is unreachable (never fail closed).
+type Cache struct {
+	Path string
+}
+
+// Write atomically stores the raw config bytes.
+func (c Cache) Write(raw []byte) error {
+	if err := os.MkdirAll(filepath.Dir(c.Path), 0o755); err != nil {
+		return err
+	}
+	tmp := c.Path + ".tmp"
+	if err := os.WriteFile(tmp, raw, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, c.Path)
+}
+
+// Read returns the cached config, or (nil, nil) when no cache exists yet.
+func (c Cache) Read() (*RenderedConfig, error) {
+	raw, err := os.ReadFile(c.Path)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return ParseRendered(raw)
+}