Add tomswall agent (control-plane pull mode)

Add `tomswall agent`: it pulls this device's compiled config from tomswallapi,
differentially applies it, and reports the applied generation. It caches the
last known-good config and, when the control plane is unreachable, keeps
applying that cache — it never fails closed.

- internal/agent: rendered-config types, HTTP client (fetch + status report),
  on-disk cache, on-device DNS resolver for dns sets (honors the device's
  configured resolver, fail-safe on lookup failure), and the pull-apply-report
  loop behind a mockable Applier.
- Translate the interface-agnostic, address-matched rendered model into native
  tomswall config using the "all:<cidr>" any-interface source/dest form, reusing
  the existing differential engine. Named-set members are inlined as concrete
  addresses (native nft set references are a tracked follow-up).
- cmd/tomswall: wire the `agent` subcommand (flags + TOMSWALL_* env, --once).
- Unit tests: translation, cache, and the don't-fail-closed fallback loop.
- Add DESIGN.md documenting the control-plane architecture.

internal/config/interfaces.go

@@ -13,14 +13,14 @@ type Interface struct {
 
 type InterfaceOptions struct {
 	// Rule generation options
-	DHCP      bool `yaml:"dhcp,omitempty"`
+	DHCP      bool  `yaml:"dhcp,omitempty"`
 	TCPFlags  *bool `yaml:"tcpflags,omitempty"`
-	NoSmurfs  bool `yaml:"nosmurfs,omitempty"`
+	NoSmurfs  bool  `yaml:"nosmurfs,omitempty"`
 	RouteBack *bool `yaml:"routeback,omitempty"`
-	Bridge    bool `yaml:"bridge,omitempty"`
-	DestOnly  bool `yaml:"destonly,omitempty"`
-	Unmanaged bool `yaml:"unmanaged,omitempty"`
-	Upnp      bool `yaml:"upnp,omitempty"`
+	Bridge    bool  `yaml:"bridge,omitempty"`
+	DestOnly  bool  `yaml:"destonly,omitempty"`
+	Unmanaged bool  `yaml:"unmanaged,omitempty"`
+	Upnp      bool  `yaml:"upnp,omitempty"`
 
 	// Startup behavior
 	Optional bool `yaml:"optional,omitempty"`