Pin meow-rs to 0.21.0 and default to the app extension

[madeye]

Summary

• Pin every meow-* git dependency to ac3fcd8 (meow-rs 0.21.0) and keep bridge_version / the FFI version test in lockstep with that workspace version.
• Treat PlugIns/TransparentProxy.appex as the default provider in docs and local deploy scripts. Debug/Release installs now require the appex, prune the Developer ID system-extension product so the two providers cannot share a bundle ID at runtime, start via the autoconnect sentinel (scutil --nc races before the NE config exists), and wait for meow engine started.
• Developer ID PKG/DMG still ship the system-extension variant (TN3134). Mac App Store already shipped the appex.
• Integration tests talk SOCKS5 as socks5h so leftover fake-ip DNS from a previous tunnel cannot poison --socks5 local resolution.

Test plan

• cargo fmt --all -- --check && cargo clippy --all-targets -- -D warnings && cargo test --lib in Rust/meow-ffi (23 passed)
• xcodebuild test … -only-testing:BaoLianDengTests (211 passed, including SOCKS5/HTTP mixed/controller)
• Local Release install: /Applications/BaoLianDeng.app with TransparentProxy.appex, engine v0.21.0, two HTTP 200 fetches over the live tunnel
• CI: make framework + Debug/Release app build

[madeye]

Review

Do not merge this PR onto current main.

The kernel pin and several of the code changes have already landed in later PRs, and a three-way merge would regress that work:

This PR	Already on main	If merged
Pin meow-rs 0.21.0 at madeye/meow-rs ac3fcd8	#106 — 0.21.1 at meow-rs/meow-rs bc38424, plus mux	Downgrade kernel, switch back to the fork, drop sing-mux
Restore global selectedNode + applySelectedNode()	#105 — per-subscription ProxyGroupSelections, selectedNode retired	Reintroduce the stale-node rewrite that #105 removed
SOCKS5 tests curl gstatic via --socks5-hostname	#107 — hermetic LocalHTTPServer + --socks5 + --noproxy	Lose the offline/IP-literal coverage #107 added
Drop controller-secret test helpers	#109 — authenticated /connections polling	Un-test the TrafficStore auth fix

Conflicts with main in Cargo.toml / Cargo.lock, VPNManager.swift, ProxyEngineHelper.swift, ProxyEngineIntegrationTests.swift, README.md, and tests/e2e/vm-stress-test.sh.

Unique leftovers (still valuable, not mergeable from this branch)

These bits of the PR are still missing on main and are worth a follow-up — they cannot be taken from this branch without the regressions above:

• bridge_version still reports "meow-rs 0.20.2" while Cargo.toml is 0.21.1
• Local deploy scripts still wait for the Go-era packet_thread: entering main loop marker, which meow-rs never logs
• Local Debug/Release installs do not prune Contents/Library/SystemExtensions or require TransparentProxy.appex
• E2E still assumes a system extension + SIP-off VM (systemextensionsctl, recovery-mode SIP disable)

Closing as superseded by #105–#109. Follow-up will pick up only those leftovers.

[madeye]

Closing as superseded. Merging would regress #105 (per-group selections), #106 (meow-rs 0.21.1 + meow-rs/meow-rs + mux), #107 (hermetic SOCKS5 target), and #109 (controller auth). Unique leftovers (appex-as-default docs/deploy/e2e, stale bridge_version string) will go in a follow-up.