fix(darwin): probe interception after the host wakes

Rule text survives a suspend unchanged, so the watchdog reports the pf
anchor intact while nothing translates, and the probe monitor is only
armed by interface changes with a schedule frozen through the sleep.
Detect the resume from the wall-clock gap and probe from there, with a
bounded repair: at most two forced reloads across the retry schedule.

Refresh the OS resolver before every probe - the probe aims at the first
OS nameserver and passes when it has none, so a pre-sleep list makes it
meaningless. Stand down for stabilization, which verifies on completion.

cmd/cli/prog.go

@@ -249,6 +249,12 @@ type prog struct {
 	pfDelayedRecheckMu     sync.Mutex    //lint:ignore U1000 used on darwin
 	pfDelayedRecheckTimers []*time.Timer //lint:ignore U1000 used on darwin
 
+	// pfSettleFollowupTimer is the pending post-settle VPN DNS refresh, if any.
+	// Tracked so teardown can cancel it and a later stabilization replaces it
+	// instead of stacking another copy of the same refresh. Protected by
+	// pfDelayedRecheckMu.
+	pfSettleFollowupTimer *time.Timer //lint:ignore U1000 used on darwin
+
 	// pfIgnoredChangeLastReconcile bounds immediate pf/VPN-DNS work for noisy
 	// ignored macOS network deltas. Tunnel changes bypass this limit, and the
 	// existing delayed checks provide a trailing reconciliation after churn.