0.3.0

• New: dead-tunnel detection. VPN_IF can stay up, address and all, while the VPN session behind it carries nothing (seen with DSM VPN Center + AirVPN: routing all green, port-test unknown, torrents stalled for hours). When the tunnel has received no bytes since the last reconcile pass, the shield probes it with a request bound to VPN_IF (at most every TUNNEL_CHECK_SEC, default 60s); 3 failed probes in a row log a WARN and, with AUTO_RECOVER_VPN, reconnect the profile, sharing the existing cooldown and 6-hour cap. A tunnel moving data is never probed.
• Fix: recover-vpn gave up with "tun0 is still up after disconnect" when DSM accepted the disconnect but left the profile's openvpn running. It now terminates those processes (--config client_<id>, TERM then KILL) before reconnecting; Transmission is already stopped at that point, so nothing can leak.
• Upgrade notes: TUNNEL_CHECK_SEC is appended to etc/guard.conf automatically.