Harden DNS proxy lifecycles and add outbound interface binding

[aarond10]

Summary

• Fix TCP framing, bound in-flight requests, and queue TCP responses without blocking the event loop.
• Preserve connection identity for asynchronous replies and drain pending TCP replies during graceful shutdown.
• Correct resolver address-change detection and retain resolve lists through HTTPS client resets.
• Allocate curl socket watchers on demand and fix primary-group handling when dropping privileges.
• Add Linux outbound interface binding for HTTPS and bootstrap DNS, with startup validation and explicit flag compatibility checks.
• Add build-only, self-contained regression tests and wire Linux interface-binding validation into CI. No new runtime library dependencies.

Validation

• All seven unit suites pass locally on macOS in normal and UBSan builds.
• git diff --check passes.
• Linux GCC/Clang and privileged kernel-binding validation await GitHub Actions.
• OpenWrt end-to-end execution has not been validated.

Review

This draft preserves the nine-commit stack for review. Please review correctness, event-loop and memory ownership, embedded resource limits, and interface-binding ergonomics before merging.

[aarond10]

@baranyaib90, the bulk of these are AI generated. I've reviewed them and they look reasonable and I'm very happy with the better test coverage we have here now. Do you have any thoughts before a squash and merge?

[baranyaib90]

Hi @aarond10, I'm kinda afraid already of the review. Last time there were plenty bugs in the pack.
Please give me a few weeks to check, before you merge. Thanks.

[aarond10]

No rush! The last set I trusted way too much and didn't check carefully. I hope I've learned a bit better since then how to go about these. Please let me know what you think.

…

On Tue, 6 Oct 2026 at 17:27, baranyaib90 ***@***.***> wrote: *baranyaib90* left a comment (aarond10/https_dns_proxy#214) <#214 (comment)> Hi @aarond10 <https://github.com/aarond10>, I'm kinda afraid already of the review. Last time there were plenty bugs in the pack. Please give me a few weeks to check, before you merge. Thanks. — Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=AABTOXSBLFWZLNGYBIVNLED5SSGDZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGA3DSMRYGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-6010692842>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABTOXRDNJTOKOGLWX2UC2T5SSGDZAVCNFSNUABEKJSXA33TNF2G64TZHM2TOMJSHA2TGOJ3JFZXG5LFHM2TOMJZGEYDMMJSGGQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AABTOXTVNGJDORD6BBLGIAL5SSGDZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGA3DSMRYGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AABTOXUJ56TWUW7A5NPKLGL5SSGDZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGA3DSMRYGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>