fix: fail closed on unverifiable platform state

[Elegying]

What changed

• macOS now captures one authoritative SystemConfiguration service/identity snapshot and rejects malformed proxy command output before mutation.
• Windows now rejects incomplete or mistyped registry snapshots instead of reconstructing user settings from silent defaults.
• Android now validates native VPN state snapshots, preserves unknown states, reports permission failures clearly, and uses platform-native separators for managed snapshot paths.
• Adds regression coverage and static guards for all three platforms.
• Bumps all clients to 4.0.3+4003 and records the release notes.

Why

The three clients had variants of the same failure mode: unverifiable platform state could be treated as a valid terminal/default state. That could surface confusing errors, overwrite user proxy settings, or delete a still-owned configuration snapshot.

User impact

Platform state is now fail-closed. SSRVPN preserves the existing system state and presents an actionable error when ownership or native status cannot be confirmed.

Validation

• Android ClashService tests: 53 passed
• Windows system proxy recovery tests: 34 passed
• macOS proxy ownership/parser tests: 10 passed
• Recovery and quality Python tests: 46 passed
• Dart analyze: Android, Windows, macOS, and shared package passed
• Version transition: 4.0.2+4002 to 4.0.3+4003 passed