v1.2.1 - CI fix + chain-integrity hardening

Fixes the red CI (logic tests still referenced the removed ensure_top) and adds a chain-integrity safeguard found in code review.

Code

• ensure_chain now verifies chain CONTENTS, not just existence. A chain that exists but lost its rules is dangerous:

  • empty chain → implicit RETURN → packet falls through → leak
  • missing the -o tun+ RETURN → even VPN traffic is rejected → permanent outage (VPN up but no internet)

  It now rebuilds whenever either required rule is absent (not just when the chain is gone). Applies to both service.sh and post-fs-data.sh.

Tests (CI green)

• logic-test.sh: dropped the obsolete ensure_top tests; now asserts the v1.2.0 invariants (ensure_top and ip monitor MUST stay absent — regression guard against the churn/sweep-storm) and tests ensure_hook install / idempotency / de-dup.
• leak-netns.sh: replaced the old DRIFT test with
  • [E] order-independence — a qualified -o tun0 ACCEPT placed above our hook still cannot leak while the VPN is down (proves ensure_top was unnecessary), and
  • [F] chain-integrity recovery — sabotage the tun+ RETURN, prove ensure_chain rebuilds it.

Local + CI: logic 5/5, netns 12/12 (incl. IPv6, allow-lan, order-independence, chain-integrity).

Guarantees unchanged

VPN down → hotspot blocked; VPN up → traffic flows. This release only hardens against a broken-chain edge case and turns CI green.