Basics 0.4.6

Adds explicit primary and peer Netkit scrub modes while preserving the kernel-default policy for existing callers. Consumers can now retain authenticated skb metadata until their own BPF trust boundary consumes and clears it. Includes focused Netlink builder coverage and an immutable Depos release artifact.