cmd/cli: skip upstream.os healthcheck when WFP loopback protect enabled

Since the check will always be failed in this case, causing unnecessary
log spamming.

cmd/cli/dns_intercept_darwin.go

@@ -1816,3 +1816,7 @@ func (p *prog) forceReloadPFMainRuleset() {
 
 	mainLog.Load().Info().Msg("DNS intercept: force reload — pf ruleset and anchor reloaded successfully")
 }
+
+// osHealthcheckSuppressed always returns false on darwin — WFP loopback
+// protect (the trigger for suppression) is Windows-only.
+func (p *prog) osHealthcheckSuppressed() bool { return false }