fix: preserve Tailscale policy rules across networkd restarts

[ajaxbits]

What this fixes

During activation of #154, systemd-networkd restarted and removed Tailscale's policy-routing rules at priorities 5210–5270 twice. Tailscale logged the deletion/restoration alongside failed NextDNS-over-HTTPS queries.

Set systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false on patroclus so networkd leaves other services' policy rules alone. The bridge design, host DNS settings, firewall, and IPv6 privacy settings remain unchanged.

Regression test

Add system.build.networkdRoutingPolicyTest, a real disposable NixOS VM test using the pinned networkd and the production host's global networkd settings.

Verified:

• IPv4 and IPv6 Tailscale-style rules survive networkd restart.
• Rules survive managed-link reconfiguration.
• Rules survive adding an editor bridge and restarting networkd.
• Negative control: explicitly restoring the old yes default deletes the rules.
• Restoring the production setting preserves the rules again.

Run from the repository root:

nix build --no-link --print-build-logs \
  .#nixosConfigurations.patroclusStripped.config.system.build.networkdRoutingPolicyTest

The complete test passed, including its negative control. Host derivation evaluation also passed. No live host networking services were restarted or reconfigured to test this change.

Scope of evidence

This fixes the confirmed foreign-policy-rule deletion. The test does not emulate NextDNS HTTPS connections or establish that this was the sole cause of the full DNS interruption; simultaneous temporary IPv6 address changes may also have contributed. Documentation records this limitation.