feat: add macOS daemon support with group-based pf routing

- Add daemon CLI subcommand (install/uninstall/status/run)
- Download tun2socks for darwin platforms in Makefile
- Export ExtractTun2Socks and add darwin embed support
- Use group-based pf filtering instead of user-based for transparent
proxying
- Install sudoers rule for passwordless sandbox-exec with _greywall
group
- Add nolint directives for gosec false positives on sudoers 0440 perms
- Fix lint issues: lowercase errors, fmt.Fprintf, nolint comments

internal/sandbox/learning.go

@@ -426,8 +426,8 @@ func buildTemplate(cmdName string, allowRead, allowWrite []string) string {
 	data, _ := json.MarshalIndent(cfg, "", "  ")
 
 	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("// Learned template for %q\n", cmdName))
-	sb.WriteString(fmt.Sprintf("// Generated by: greywall --learning -- %s\n", cmdName))
+	fmt.Fprintf(&sb, "// Learned template for %q\n", cmdName)
+	fmt.Fprintf(&sb, "// Generated by: greywall --learning -- %s\n", cmdName)
 	sb.WriteString("// Review and adjust paths as needed\n")
 	sb.Write(data)
 	sb.WriteString("\n")