fix: OpenWrt 25.12 compatibility fixes, startup speedup, and Telegram polling fix

- wget: remove -t flag incompatible with BusyBox 25.12+, add curl-first fallback
  in download_to_file() with wget as fallback

- startup/reload speedup (5 improvements):
  - cut sing-box verification timeout from 45 iterations to 15
  - remove redundant second stability wait for sing-box process
  - batch requirement check + runtime validation into single ucode fork
  - replace dnsmasq full restart with procd reload (config-conditional bounce)
  - move telegram and watchdog runtime start to background

- telegram: fix "API failure" spam - empty result[] from getUpdates is now
  treated as a successful idle poll, not an error that triggers backoff

- watchdog SmartDetect: extract domain from proxy and VPN URLs for DNS
  health check, use real domains (google.com/example.com) instead of
  provider-specific endpoints that trigger false alerts

- tests: new invariants for wget -t prohibition, telegram empty-result
  handling, DNS apply reload-vs-restart, and combined validation mode ownership

tests/telegram_empty_result.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TELEGRAM="$ROOT_DIR/tachyon/files/usr/lib/service/telegram.uc"
+
+fail() {
+  printf 'FAIL: %s\n' "$1" >&2
+  exit 1
+}
+
+# process_updates() must treat an empty result array as a success (no new
+# updates is a normal API response), not as a failure that increments the
+# backoff counter.
+#
+# Before the fix, the guard was:
+#   if (!res || !res.ok || !res.result || length(res.result) == 0) return false;
+# This counted "result: []" as a failure, causing a permanent "API failure"
+# spam and exponential backoff on every poll.
+#
+# After the fix, the guard is split:
+#   if (!res || !res.ok || !res.result) return false;   // real errors
+#   if (length(res.result) == 0) return true;            // idle poll
+
+# The fix: empty result must not be gated by a single expression that also
+# returns false for !res.ok. Verify the two checks are separate statements.
+grep -Fq 'result) == 0) return true' "$TELEGRAM" ||
+  fail "process_updates must return true on empty result[] (idle poll)"
+
+# Verify the error guard does NOT include the length==0 check.
+if grep -Fq 'length(res.result) == 0) return false' "$TELEGRAM"; then
+  fail "process_updates must NOT return false when result[] is empty"
+fi
+
+printf 'telegram empty result checks passed\n'