Add macOS support, fix bloom filter routing and MMP intervals

macOS platform:
- Platform-native TUN interface management with shutdown pipe
- Raw Ethernet transport with macOS socket backend (socket_macos.rs)
- EthernetTransport and TransportHandle::Ethernet ungated from Linux-only
- macOS .pkg packaging (build-pkg.sh, launchd plist, uninstall script)
- CI: macOS build and unit test jobs; x86_64 cross-compiled from
  macos-latest via rustup target add x86_64-apple-darwin

Gateway feature flag:
- New opt-in `gateway` Cargo feature activates optional `rustables` dep
- `pub mod gateway` and `Config.gateway` gated behind the feature so
  macOS builds never pull in Linux-only nftables bindings
- `fips-gateway` bin has `required-features = ["gateway"]`
- All Linux/OpenWrt/AUR packaging passes `--features gateway`

CI / packaging:
- package-linux, package-macos, package-openwrt now trigger on push to
  master/maint/next and on pull requests; release uploads remain tag-gated
- Bloom filter routing fix: fall through to tree routing when no candidate
  is strictly closer
- MMP intervals: raise MIN to 1s / MAX to 5s with 5-sample cold-start phase

Cargo.toml

@@ -12,6 +12,7 @@ readme = "README.md"
 default = ["tui", "ble"]
 tui = ["dep:ratatui"]
 ble = ["dep:bluer"]
+gateway = ["dep:rustables"]
 
 [dependencies]
 ratatui = { version = "0.30", optional = true }
@@ -32,14 +33,17 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tun = { version = "0.8.5", features = ["async"] }
 libc = "0.2"
-rtnetlink = "0.20.0"
 tokio = { version = "1", features = ["rt", "macros", "signal", "sync", "net", "time", "process"] }
 futures = "0.3"
 simple-dns = "0.11.2"
 socket2 = { version = "0.6.2", features = ["all"] }
 tokio-socks = "0.5"
+
+rustables = { version = "0.8.7", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+rtnetlink = "0.20.0"
 bluer = { version = "0.17", features = ["bluetoothd", "l2cap"], optional = true }
-rustables = "0.8.7"
 
 [package.metadata.deb]
 maintainer = "Johnathan Corgan <jcorgan@corganlabs.com>"
@@ -82,6 +86,7 @@ path = "src/bin/fipsctl.rs"
 [[bin]]
 name = "fips-gateway"
 path = "src/bin/fips-gateway.rs"
+required-features = ["gateway"]
 
 [[bin]]
 name = "fipstop"