fix(providers): resolve zapret2 startup crash, nft desync EPERM, and mieru ruleset crash loop

- fix(zapret2): add safe_str fallback and avoid default --filter-tcp=443 injection on UDP rules in prepare_strategy_args()
- fix(providers): make individual rule failures non-fatal in start_runtime() so one bad rule does not rollback all running rules
- fix(binaries): dynamic candidate resolution for nfqws and nfqws2 across standard OpenWrt and custom paths (/opt/zapret2/nfq2, /opt/zapret2/nfq, /opt/zapret2, /usr/bin)
- fix(nft): add raw_output notrack chain and mangle_output/forward counter return rules for desync marks (0x40000000, 0x20000000) and musl/nobody skuid (2147483647, 65534) to prevent EPERM rawsend failure on reload
- fix(reload): ensure nft_rebuild is triggered on zapret and zapret2 runtime updates
- fix(singbox): reject mieru outbounds from rule_set download_detour and http_clients dial_detour to prevent fatal startup crash loop
- fix(singbox): detect sing-box 1.14+ and omit deprecated download_detour on remote rule-sets when http_clients is active
- fix(action): pre-seed /etc/config/zapret2 with enabled=0 via core.uci before package install to prevent conflicting upstream daemon startup
- test(ruleset): add verification tests for mieru download_detour and dial_detour rejection

tachyon/files/usr/lib/service/reload.uc

@@ -93,8 +93,10 @@ function emit_reload_plan(previous, current, context) {
         needs.sing_box_reload = true;
     }
 
-    if (changed.zapret_runtime)
+    if (changed.zapret_runtime) {
         needs.zapret_restart = true;
+        needs.nft_rebuild = true;
+    }
 
     if (changed.zapret2_queue) {
         needs.zapret2_restart = true;
@@ -102,8 +104,10 @@ function emit_reload_plan(previous, current, context) {
         needs.sing_box_reload = true;
     }
 
-    if (changed.zapret2_runtime)
+    if (changed.zapret2_runtime) {
         needs.zapret2_restart = true;
+        needs.nft_rebuild = true;
+    }
 
     if (changed.byedpi_runtime)
         needs.byedpi_restart = true;