fix(stability): optimize Go memory tiers, prevent nftables degradation deadlock, harden NTP & process supervision

- singbox/runtime.uc: add dynamic 4-tier GOMEMLIMIT and GOGC limits based on RAM, enforce /etc/tachyon/mem_scale, and install managed init script across all binary variants
- service/event_controller.uc: guard probe_nftables() with recovery_bypass and native_internet_restored checks to prevent 5-minute network drop deadlock
- service/watchdog.uc: reduce Telegram worker heartbeat timeout from 900s to 300s and add nslookup fallback to Zero-RTT prefetcher
- diagnostics/runtime.uc & service/lifecycle.uc: use direct-IP NTP pool to eliminate circular DNS/TLS deadlocks, and step clock forward on cold boot if RTC desynced
- service/failover.uc & diagnostics/runtime.uc: flush conntrack states on proxy group switch so client connections immediately migrate

tachyon/files/usr/lib/service/event_controller.uc

@@ -642,6 +642,8 @@ function controller(bus, opts) {
 
     // ── Probe: nftables table and QoS marks ───────────────────────────────────
     function probe_nftables() {
+        if (setting("recovery_bypass", "0") == "1") return;
+        if (fs.stat("/var/run/tachyon/native_internet_restored") != null) return;
         if (is_list_update_running()) return;
         if (is_reload_in_progress()) return;
 
@@ -666,6 +668,7 @@ function controller(bus, opts) {
     // ── Probe: TPROXY port liveness ───────────────────────────────────────────
     function probe_tproxy() {
         if (setting("recovery_bypass", "0") == "1") return;
+        if (fs.stat("/var/run/tachyon/native_internet_restored") != null) return;
         if (is_reload_in_progress()) return;
 
         let pid = get_sing_box_pid();