v0.3.7 — Routing enforced on in-process cores

Fixes

• The policy plane now ALSO deploys rules + outbounds through the native core drivers: xray/sing-box route inside their own processes, so routing rules actually reach node inbounds (previously only the host nft plane was fed and xray/sing-box traffic ignored every rule).
• A host policy-plane failure (e.g. no sing-box binary on an xray-only node) no longer blocks the native application.
• Managed routing state is persisted (.managed.json sidecar) and re-applied on agent boot and on every inbound re-sync — routing survives agent restarts.
• Agent version string corrected: 0.3.5 → 0.3.7.

Upgrade nodes to v0.3.7 to get node-side routing enforcement (panel v1.1.3 re-release pairs with it). Outdated agents are skipped with an honest note instead of pretending.

Third-party notices

• sing-box is GPL-licensed and runs out-of-process; this repository distributes no sing-box code. See NOTICE.