Port DNS64, VPN routing and DNS recovery ownership to master

Retain master's context-aware VPN and resolver APIs, per-program logger,
shutdown fencing, native CLAT service identity and firewall behavior.
Keep saved-DNS paths owned by the root ctrld package; isolate the added
ownership/sweep tests with a shared path seam and temporary backups.

Preserve the source DNS64 DNSSEC/cache gates, longest-suffix VPN routing,
DNS-journal convergence, scoped IPv6 handling, target ownership checks,
custom-listener regressions and documented native QA limits.

cmd/cli/cli.go

@@ -1558,12 +1558,20 @@ func uninstall(p *prog, s service.Service) {
 	}
 }
 
+var restoreSavedStaticDNSInterfacesFn = withEachPhysicalInterfaces
+var restoreSavedStaticDNSRestoreFn = restoreDNS
+var savedStaticDNSPathFn = ctrld.SavedStaticDnsSettingsFilePath
+
 // restoreSavedStaticDNS restores DNS from saved static config files on physical interfaces.
 func restoreSavedStaticDNS(excludeIfaceName string, removeSaved bool) {
-	withEachPhysicalInterfaces(excludeIfaceName, "restore static DNS", func(i *net.Interface) error {
-		file := ctrld.SavedStaticDnsSettingsFilePath(i)
+	restoreSavedStaticDNSInterfacesFn(excludeIfaceName, "restore static DNS", func(i *net.Interface) error {
+		if !interceptTargetAllowsStaticRestore(i.Name) {
+			mainLog.Load().Debug().Msgf("Saved static DNS restore skipped on interface %s: intercept target cleanup is pending or ownership is unreadable", i.Name)
+			return nil
+		}
+		file := savedStaticDNSPathFn(i)
 		if _, err := os.Stat(file); err == nil {
-			if err := restoreDNS(i); err != nil {
+			if err := restoreSavedStaticDNSRestoreFn(i); err != nil {
 				mainLog.Load().Error().Err(err).Msgf("Could not restore static DNS on interface %s", i.Name)
 			} else {
 				mainLog.Load().Debug().Msgf("Restored static DNS on interface %s successfully", i.Name)