NetworkGuard runtime enforcement.
translate now registers a URLProtocol at startup that hard-exits the process (exit 2) on any URLSession HTTP/HTTPS/WS/WSS attempt. The "100% on-device" promise is now belt-and-suspenders: README claim plus runtime kill-switch.
The HTTP server (--serve) is unaffected — Hummingbird opens kernel sockets, which URLProtocol does not see. The guard only intercepts URLSession traffic, which is exactly the surface a future bug could leak through.
140 tests, 0 failures (was 136).