feat: add macOS daemon support with group-based pf routing

- Add daemon CLI subcommand (install/uninstall/status/run)
- Download tun2socks for darwin platforms in Makefile
- Export ExtractTun2Socks and add darwin embed support
- Use group-based pf filtering instead of user-based for transparent proxying
- Install sudoers rule for passwordless sandbox-exec with _greywall group
- Add nolint directives for gosec false positives on sudoers 0440 perms
- Fix lint issues: lowercase errors, fmt.Fprintf, nolint comments

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/daemon/server.go

@@ -24,10 +24,10 @@ type Request struct {
 
 // Response from daemon to CLI.
 type Response struct {
-	OK          bool   `json:"ok"`
-	Error       string `json:"error,omitempty"`
-	SessionID   string `json:"session_id,omitempty"`
-	TunDevice   string `json:"tun_device,omitempty"`
+	OK           bool   `json:"ok"`
+	Error        string `json:"error,omitempty"`
+	SessionID    string `json:"session_id,omitempty"`
+	TunDevice    string `json:"tun_device,omitempty"`
 	SandboxUser  string `json:"sandbox_user,omitempty"`
 	SandboxGroup string `json:"sandbox_group,omitempty"`
 	// Status response fields.