experimental/windivert: P2.1+P2.2 with WinDivert NETWORK+SOCKET layers

WIP snapshot before pivot to sing-box+TUN. Reached:
- TCP redirect via streamdump pattern (swap+Outbound=0+reinject)
- SOCKET layer for SYN-stage flow detection (avoids FLOW Establish-too-late race)
- Lazy PID→name resolution (catches Update.exe inside procscan tick)
- UDP forward via SOCKS5 UDP ASSOCIATE relay + manual reinject
- Result: chat works, voice times out (Discord IP discovery / RTC handshake fails)

Reason for pivot: WinDivert NAT-reinject pattern has subtle layer-3
semantics issues that DLL-injection / TUN-based proxies sidestep
entirely. Going with embedded sing-box + wintun as the engine —
proven path for Discord voice through SOCKS5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/drover/proxy_other.go

@@ -0,0 +1,14 @@
+//go:build !windows
+
+package main
+
+import (
+	"context"
+	"fmt"
+)
+
+// runProxy stub for non-Windows builds (drover only ships for Windows;
+// this stub keeps `go build ./...` clean on Linux dev/CI machines).
+func runProxy(_ context.Context, _ string, _ int, _ bool, _, _ string) error {
+	return fmt.Errorf("the proxy subcommand requires Windows (WinDivert is Windows-only)")
+}