v0.2.3

I started fuzzing the parsers that read what Aegis doesn't control, and
within seconds the fuzzer found the first fix below. The other two
close the last gaps the v0.2.1 review left around nftables reloads.

Fixed

• On a host up for more than about 5.8 years, aegisd worked out every
  new process's start time wrong, so it took live processes for exited
  ones: it dropped them from its process table, treated their
  environments as unreadable, and left them out of a quarantine or
  throttle. The overflow behind it is gone.
• A systemctl reload nftables that landed between two nft calls
  could make a working enforcement look broken. If it hit while the
  10-second check was putting a drop rule back, the incident recorded a
  failed nft_drop and your webhook got "enforcement failed", although
  the next check fixed it. If it hit during a release or kill, you got
  an error even though the rule was gone and the network was back. Now
  aegisd looks at the table again when an nft call fails: a missing
  table is recreated and the rule added once more, and a rule that's
  already gone is recorded as "the rule was already gone".
• A tree that aegisd moved into its quarantine scope but couldn't
  freeze (verdict would_quarantine) had a drop rule, and lost it for
  good to the first nftables reload. Its kernel holds still blocked the
  processes aegisd had held, but not a child it moved without holding
  yet, and they all go when aegisd restarts. The 10-second check now
  puts the rule back too, while any of the tree is still in the scope.
  In enforce mode it also adds one if the first attempt failed, recorded
  as "added late: the first attempt failed". In audit mode, as before,
  only a rule that enforce mode added comes back.