refactor(network): manage routing with SystemConfiguration

[Afcoo]

Summary

Replace direct host route mutation and route-table parsing with an owned
SystemConfiguration Network Service on the managed Ethernet Bond. macOS
SystemConfiguration/configd now owns route synthesis and reconciliation, while
the user retains control of network-service priority.

Changes

• remove RouteCommandRunner, the explicit global/scoped /1 route model, and
  installed-prefix status/UI
• configure the owned Bond service with the managed IPv4 address, subnet,
  router, DNS, and disabled IPv6 through public SystemConfiguration APIs
• add a focused SCPreferences transaction helper for locking, commit, and apply
• verify the persisted IPv4 service configuration and the Bond/feth/bridge L2
  path without claiming a kernel route-table acknowledgement
• roll back activation by disabling the service through a fresh SCPreferences
  transaction and retain exact ownership metadata for restart cleanup
• leave service ordering entirely under user control

Related issue

None.

Validation

• ./script/build_and_run.sh --verify
• Checks run and unverified runtime paths are documented
• Signed Runtime validation with ./script/build_and_install.sh
• Real USB/VZNAT route validation
• Not applicable; signed helper/USB/RNDIS runtime validation requires the
  approved entitlements and physical hardware. Verified instead with:
  • plutil -lint for the project, plists, and entitlements
  • xmllint --noout for both shared schemes
  • jq empty ThruRNDIS/Resources/Localizable.xcstrings
  • xcodebuild -project ThruRNDIS.xcodeproj -list
  • unsigned Debug build with CODE_SIGNING_ALLOWED=NO
  • git diff --check

User-facing impact

The managed Network Service appears in macOS network settings without changing
the user's service priority. Debug Settings no longer reports explicit /1
prefixes, and event logs describe the verified managed network path rather than
claiming that a kernel route is active. No screenshot is needed for the removed
debug-only row.

Security and architecture

All host network mutation remains in the authenticated privileged helper. The
helper no longer executes /sbin/route, parses netstat, uses routing sockets,
or links private SystemConfiguration symbols. Bond and Network Service ownership
remain bound to the recorded service identifier and SystemConfiguration
metadata; cleanup touches only those recorded objects.

Checklist

• The pull request has one focused purpose.
• The title follows Conventional Commits, for example fix(usb): serialize detach handling.
• Behavior changes include appropriate build or runtime validation, with unavailable paths explained.
• User-facing behavior and operational changes are documented.
• New, moved, renamed, or deleted Swift files are reflected in Xcode groups, target membership, and build phases.
• No credentials, provisioning profiles, personal signing values, or local build artifacts are included.
• Guest VM scripts and VM Asset build tooling remain in Afcoo/ThruRNDIS_VM_Assets.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T13:39:27.056674Z	14d6a72	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.