RUST-FEAT-005 — Automated VPN leak-test — assert no data egress off the tunnel (release-blocking)

[itlezy]

Release-blocking per the WORKSPACE-POLICY Network Safety (no clearnet leak) P0 invariant. Spec: https://github.com/emulebb/emulebb-rust/blob/main/docs/active/items/RUST-FEAT-005.md