feat: introduce DNS intercept mode infrastructure

Add --intercept-mode flag (dns/hard/off) with configuration support,
recovery bypass for captive portals, probe-based interception
verification, VPN DNS coexistence in the proxy layer, and IPv6
loopback listener guard.

Remove standalone mDNSResponder hack files — the port 53 binding
logic is now handled within the intercept mode infrastructure.

Squashed from intercept mode development on v1.0 branch (#497).

config_internal_test.go

@@ -541,10 +541,12 @@ func TestRebootstrapRace(t *testing.T) {
 	<-started
 
 	var wg sync.WaitGroup
+	wg.Add(goroutines)
 	for range goroutines {
-		wg.Go(func() {
+		go func() {
+			defer wg.Done()
 			uc.ensureSetupTransport()
-		})
+		}()
 	}
 
 	wg.Wait()