fix: restore v1 intercept parity on master

Restore the previously merged macOS VPN DNS post-settle refresh,
unchanged-exemption suppression, forced pf state flush, and self-upgrade
test after they were removed by the firewall-mode merge.

Also keep Windows NRPT pointed at loopback when the listener is configured
on a wildcard address.

cmd/cli/vpn_dns_test.go

@@ -101,6 +101,31 @@ func TestVPNDNSRefreshClearsOnSecondGuardedEmptyDiscovery(t *testing.T) {
 	}
 }
 
+func TestVPNDNSRefreshSkipsUnchangedInterceptExemptions(t *testing.T) {
+	var updates [][]vpnDNSExemption
+	m := newVPNDNSManager(&mainLog, func(exemptions []vpnDNSExemption) error {
+		updates = append(updates, append([]vpnDNSExemption{}, exemptions...))
+		return nil
+	})
+	m.discoverVPNDNS = func(context.Context) []ctrld.VPNDNSConfig {
+		return []ctrld.VPNDNSConfig{{
+			InterfaceName: "utun-test",
+			Servers:       []string{"10.102.26.10"},
+			Domains:       []string{"example.internal"},
+		}}
+	}
+
+	m.Refresh(context.Background(), true)
+	m.Refresh(context.Background(), true)
+
+	if len(updates) != 1 {
+		t.Fatalf("expected exactly one intercept exemption update for unchanged VPN DNS state, got %d", len(updates))
+	}
+	if len(updates[0]) != 1 || updates[0][0].Server != "10.102.26.10" || updates[0][0].Interface != "utun-test" {
+		t.Fatalf("unexpected exemption update: %+v", updates[0])
+	}
+}
+
 func TestVPNDNSTransportFailureSuppressesFallbackOnlyWhileRetainingState(t *testing.T) {
 	withVPNDNSSettlingEnabled(t)
 	m := newVPNDNSManager(&mainLog, nil)