feat: add macOS daemon support with group-based pf routing

- Add daemon CLI subcommand (install/uninstall/status/run)
- Download tun2socks for darwin platforms in Makefile
- Export ExtractTun2Socks and add darwin embed support
- Use group-based pf filtering instead of user-based for transparent
proxying
- Install sudoers rule for passwordless sandbox-exec with _greywall
group
- Add nolint directives for gosec false positives on sudoers 0440 perms
- Fix lint issues: lowercase errors, fmt.Fprintf, nolint comments

internal/sandbox/tun2socks_embed_stub.go

@@ -1,10 +1,10 @@
-//go:build !linux
+//go:build !linux && !darwin
 
 package sandbox
 
 import "fmt"
 
-// extractTun2Socks is not available on non-Linux platforms.
-func extractTun2Socks() (string, error) {
-	return "", fmt.Errorf("tun2socks is only available on Linux")
+// ExtractTun2Socks is not available on unsupported platforms.
+func ExtractTun2Socks() (string, error) {
+	return "", fmt.Errorf("tun2socks is only available on Linux and macOS")
 }