v1.3.0

Fixes from a full-project review focused on systems-interaction bugs (code that was valid but assumed the wrong daemon behavior).

Fixes

• systemd-networkd persistence redesigned as drop-ins. networkd applies exactly one .network file per link (first lexical match), so the old standalone 50-sbr-<iface>.network files either shadowed the link's real config (stripping its address management) or were silently ignored. SBR settings now go into <applied-file>.network.d/50-sbr.conf, discovered from networkd's runtime state. Legacy standalone files are removed automatically on the next persistence run or rollback. Interfaces networkd doesn't manage are skipped with a warning.
• netplan persistence now merges instead of clobbering. Netplan replaces list values wholesale across files, so the old 90-sbr-config.yaml deleted user-defined static routes on managed interfaces at netplan apply. Existing routes and routing-policy entries are now re-emitted (deduped) alongside SBR's, interfaces land under their real section (vlans:/bonds:/bridges:), and a later-sorting conflicting file triggers a warning.
• VLAN interfaces no longer break configure. Per-interface rp_filter now uses explicit /proc paths for reads and sysctl slash notation (net/ipv4/conf/eth0.100/rp_filter) for writes, so dotted interface names aren't mangled into failing commands that rolled back the whole apply.
• Self-heal hardened: never writes during --dry-run; failures downgrade to warnings instead of tracebacks; staleness is now content-comparison against the desired file (heals 1.2.0 per-interface keys, 1.1.x delta files, and future drift, and can't false-match admin files); the sysctl.d file is created when SBR is active but persistence is missing; rollback immediately heals a restored pre-1.2.1 sysctl file so old backups can't reintroduce ib* boot errors.
• ifupdown finds interface stanzas in sourced interfaces.d files and appends there rather than creating a conflicting duplicate stanza; removal strips sbr-config lines from user-owned files but never deletes them.
• NetworkManager backend warns when a device is NM-unmanaged (the dispatcher never fires for those).
• Clean --configure runs warn when runtime SBR is correct but no interface persistence exists.

Notes

• The networkd drop-in mechanism requires systemd with .network.d drop-in support (v240+; stock on Ubuntu 20.04+/Debian 11+). On older systemd without networkctl reload, drop-ins take effect at the next networkd restart or reboot.
• Verified with 65 unit-level assertions; live validation on netplan/networkd distros is planned as follow-up.

Release on top of v1.2.1.