v0.2.1

v0.2.0 made Aegis act. This release closes the hole a routine
systemctl reload nftables opened in that, and tidies what the v0.2.0
review left behind: a STATE column that says what's in place now, a
freeze that retries, and a shutdown that finishes its work.

Upgrading from 0.2.0. There's nothing to migrate. Incidents 0.2.0
recorded get their STATE the first time you list them. An incident
that was quarantined and lost its rule to an earlier reload gets the
rule back within about 10 seconds of the restart. One catch: the
"Stopping aegisd lets the enforcer finish first" fix below can't cover
the upgrade itself, because it's the 0.2.0 binary that shuts down. A
quarantine caught mid-flight by that restart may still go unrecorded.

Fixed

• An nftables reload no longer gives quarantined trees their network
  back. In v0.2.0, systemctl reload nftables (or any ruleset flush)
  deleted the inet aegis table and every drop rule in it, and nothing
  put them back. Now aegisd checks every 10 seconds and re-adds the
  table and each missing rule, recording an nft_drop that says why.
  In audit mode it only restores rules enforce mode added. Release and
  kill also stop trusting the handle they recorded, which a reload
  could hand to another incident's rule: they look the rule up by the
  tree's cgroup and delete only that. Kill looks it up before the
  SIGKILL, while nftables can still name the cgroup. If the scope is
  already gone, release falls back to the recorded handle, but only
  when nftables shows that rule with a bare cgroup id. If the rule's
  already gone, release still succeeds and says so. (#53)
• A quarantine on a busy host gets frozen, not just held. busctl
  hands back as soon as systemd queues the scope's start job, so the
  freeze straight after it could find the scope not yet running. The
  tree then stayed held but unfrozen, at would_quarantine. Now a
  freeze that fails, on a scope the kernel says isn't frozen, gets one
  more try 200 ms later.
• Stopping aegisd lets the enforcer finish first. A SIGTERM that
  landed mid-quarantine (a dnf upgrade restart, say) could leave a
  tree moved or frozen with nothing written down, and the next release
  then said "never enforced". Shutdown now waits up to 5 seconds for the
  job in hand and anything still queued.
• A drop rule whose first try failed gets added later. In enforce
  mode, if the nft call that should have blocked a quarantined tree
  failed, nothing came back for it. Now the 10-second check adds it,
  and the record says added late: the first attempt failed.
• nft runs from /usr/bin/nft when that's the only copy. The
  config check already looked there; the enforcer didn't. Stock Rocky 10
  has both, so you'll only notice on a trimmed image.
• The "queue full" alert names the incident's score and root
  process. It used to arrive with a score of 0 and no process name.
• An attach on the record means something moved. When every
  newcomer was already in the quarantine scope, or had already exited,
  aegisd still wrote an attach with ok: true and their pids. Now it
  writes nothing.

Changed

• Actions in incident.json can carry a detail field, and
  incidents show prints it. It says why an action happened, such as a
  rule re-added after a reload. If you parse the records: a removal
  that finds the rule already gone is now an ok nft_remove with no
  nft_handle, where it used to be an error.
• incidents list has a STATE column. The verdict is history, so
  a tree you'd released still showed quarantined and nothing said
  otherwise. STATE says what's in place now: throttled,
  quarantined, held (kernel holds only), released, killed,
  expired, or - when nothing was enforced. --json carries it as
  state. Scripts that read the table by column position will
  find SCORE and everything after it one column to the right.
• A release or kill that outlasts the enforcer wait says it's still
  queued. It used to say "timed out waiting for the enforcer", which
  sounded like a failure. The job always ran anyway, and running it a
  second time got you an "is already released" error. Worse, aegisctl's
  own 30-second deadline usually ran out first, so you saw "no reply
  from aegisd" instead. aegisd now waits 25 seconds, then tells you to
  check aegisctl incidents show <id> shortly.