v1.3.1

Fixes for three bugs caught by live VM validation on Ubuntu 26.04 (netplan) and Amazon Linux 2023 (systemd-networkd) -- all in the "code was valid, the world disagreed" class.

Fixes

• DHCP lease lookups are now scoped to the interface. The systemd-networkd lease search used an unscoped glob, so any interface could inherit the router from another NIC's lease -- a VLAN with no gateway got its parent's, and the resulting default route failed the apply (or misrouted traffic). networkd leases are now read by ifindex; dhclient paths remain interface-parameterized.
• Routing table allocation avoids kernel-active numeric tables. The planner only treated rt_tables entries as used, but cloud-init and amazon-ec2-net-utils do policy routing with numeric-only tables (e.g. 101, 10001) that never appear in rt_tables. sbr-config could allocate the same number, aliasing its named table onto theirs -- and rollback's table flush would then destroy their routes. The detector now collects every table id referenced by active routes or rules and the planner skips them.
• Netplan persistence skips interfaces netplan doesn't define. Writing an entry for a netplan-unmanaged interface (e.g. a manually created VLAN) caused networkd to take over the link with no address config, stripping its addresses on apply. Such interfaces are now skipped with an explicit warning, matching the networkd backend's unmanaged-link policy.
• The netplan config file is written mode 0600 (netplan warns on world-readable config).

Validation

Full pass on both distros: configure, reboot persistence, rollback to byte-identical pre-test state, VLAN (dotted-name) handling, and coexistence with cloud-init and amazon-ec2-net-utils policy routing. Note: amazon-ec2-net-utils persists its own policy routing via the same networkd drop-in mechanism sbr-config now uses. Expected behavior note: networkctl reload at persist time briefly reconfigures the SBR interface (~2s route flap) before the settled state lands.

Release on top of v1.3.0.