v0.5.0 — object-aware parsing + management-plane audit

v0.5.0 — object-aware parsing + management-plane audit

Builds on v0.4.0 (source-traceable IR + security acceptance audit). Every parsed
value still carries a SourceRef back to its exact file:line.

New parsing (with SourceRef)

• nat-policy rules (zones / addresses / service / action)
• ip address-set and ip service-set named objects (members, type, raw expressions)
• Management-plane switches: telnet server enable / http server enable (and their undo forms)

Audit: 5 → 9 checks

• FW-PERMIT-SCOPE now dereferences address-set references — a permit rule
  whose only narrowing is an address-set that resolves to 0.0.0.0/0 is still flagged
  (a permit-any hidden behind a named object).
• FW-ADDRESS-SET-ANY — an address-set member equal to 0.0.0.0/0 (any).
• FW-HRP-INCOMPLETE — HRP enabled but heartbeat interface / remote peer missing
  (an HA pair that will not sync).
• FW-MGMT-TELNET / FW-MGMT-HTTP — cleartext management protocols enabled.

Every finding cites the exact config line as evidence; --strict exits non-zero for CI gating.

Quality

• Zero runtime dependencies in the core.
• 80 stdlib unittest cases; CI green (tests + regression + CodeQL).

vrp-ir is the open core of AegisTwin (Huawei security-integration acceptance workbench).