Add macOS support, fix bloom filter routing and MMP intervals

macOS platform:
- Platform-native TUN interface management with shutdown pipe
- Raw Ethernet transport with macOS socket backend (socket_macos.rs)
- EthernetTransport and TransportHandle::Ethernet ungated from Linux-only
- macOS .pkg packaging (build-pkg.sh, launchd plist, uninstall script)
- CI: macOS build and unit test jobs; x86_64 cross-compiled from
  macos-latest via rustup target add x86_64-apple-darwin

Gateway feature flag:
- New opt-in `gateway` Cargo feature activates optional `rustables` dep
- `pub mod gateway` and `Config.gateway` gated behind the feature so
  macOS builds never pull in Linux-only nftables bindings
- `fips-gateway` bin has `required-features = ["gateway"]`
- All Linux/OpenWrt/AUR packaging passes `--features gateway`

CI / packaging:
- package-linux, package-macos, package-openwrt now trigger on push to
  master/maint/next and on pull requests; release uploads remain tag-gated
- Bloom filter routing fix: fall through to tree routing when no candidate
  is strictly closer
- MMP intervals: raise MIN to 1s / MAX to 5s with 5-sample cold-start phase

packaging/README.md

@@ -10,6 +10,7 @@ make deb        # Debian/Ubuntu .deb
 make tarball    # systemd install tarball
 make ipk        # OpenWrt .ipk
 make aur        # Arch Linux AUR package (fips-git, local build + namcap)
+make pkg        # macOS .pkg installer
 make all        # deb + tarball (default)
 ```
 
@@ -20,6 +21,7 @@ packaging/
   aur/            Arch Linux AUR packaging (PKGBUILD, supporting files)
   common/         Shared assets (default config, hosts file)
   debian/         Debian/Ubuntu .deb packaging via cargo-deb
+  macos/          macOS .pkg installer via pkgbuild
   systemd/        Generic Linux systemd tarball packaging
   openwrt/        OpenWrt .ipk packaging via cargo-zigbuild
 ```
@@ -80,6 +82,25 @@ bash packaging/openwrt/build-ipk.sh --arch mipsel
 See [openwrt/README.md](openwrt/README.md) for router-specific
 installation instructions.
 
+### macOS (`.pkg`)
+
+Built with `pkgbuild` (included with Xcode command-line tools). Installs
+binaries to `/usr/local/bin/`, config to `/usr/local/etc/fips/`, sets up
+the `/etc/resolver/fips` DNS resolver for `.fips` domains, and loads a
+launchd daemon. The TUN device is named `utun<N>` (kernel-assigned)
+rather than `fips0`.
+
+```sh
+# Build
+make pkg
+
+# Install
+sudo installer -pkg deploy/fips-<version>-macos-<arch>.pkg -target /
+
+# Remove
+sudo packaging/macos/uninstall.sh
+```
+
 ### Arch Linux (AUR)
 
 Two AUR packages are maintained: `fips` (release, builds from tagged