v2.1.0 — resolver flush on WARP toggle, real DNS failover

Toggling WARP off left the resolver answering from a poisoned cache — which reads as "no internet" while the network is actually fine.

Fixed

warp-tray now flushes the resolver after any WARP state change. Tearing the tunnel down kills every DNS lookup in flight over it. Those fail DNSSEC validation with failed-auxiliary, because the transport carrying the DS and DNSKEY chain vanished mid-lookup, and systemd-resolved caches the failure. Firefox's captive-portal probe is usually among the casualties, and one failed probe is enough for it to declare the link down.

The teardown itself is clean — verified, not assumed. With WARP disconnected the nftables table, the ip rule and routing table 65743 are all gone, the route falls back to the LAN gateway, and both ping and DNS work. Only the cache is stale.

resolvectl flush-caches and reset-server-features now run after any state change, on a thread so the tray's event loop isn't blocked; the killswitch menu path flushes too. Measured across a teardown with lookups deliberately in flight: 4 of 12 probes failed without the flush, 0 of 12 with it. One run, small sample — directional, not a proof.

dns-toggle now appends Quad9 to DNS=, giving real resolver failover. FallbackDNS= never provided this. Per resolved.conf(5) it is "only used if no other DNS server information is known" — only when DNS= is empty. It is not consulted when the servers in DNS= stop answering, which is exactly the case people assume it covers. Both branches previously listed a single provider, so both entries failed together.

The trade-off is documented in the script: resolved sticks with whichever server last worked, so after a failover you stay on Quad9 — malware filtering, no ad blocking — until it restarts.

Packaging bug: the tray icons were never shipped. Both applets load icons by absolute path from ~/.local/share/icons, but the repository didn't contain them, so a fresh install produced trays with no artwork — which looks like a crash. All four SVGs now ship in share/icons/ and install.sh places them.

Added

A README section on the two tray toggles, with an annotated screenshot showing each icon in place and what both of its states mean.