fix(macos): restore system DNS reliably after TUN

Detached tasks spawned on every config generation set and restored the
placeholder DNS without ordering, so a set could back up the placeholder
itself and a later restore reported success while leaving it in place.

Reconcile from the applied config under the lifecycle lock, and restore
whenever the core stops. Keep one backup per network service, never back
up the placeholder, and restore only while the service still holds it.
Scripts verify every read and write and are killed after 5 s.

Refs #8070, #8168

src-tauri/src/utils/resolve/mod.rs

@@ -21,6 +21,7 @@ use crate::{
 use clash_verge_logging::{Type, logging, logging_error};
 use clash_verge_signal;
 
+#[cfg(target_os = "macos")]
 pub mod dns;
 mod scheme;
 pub(crate) mod window;
@@ -102,7 +103,7 @@ pub async fn resolve_reset_async() -> Result<(), anyhow::Error> {
     #[cfg(target_os = "macos")]
     {
         use dns::restore_public_dns;
-        restore_public_dns().await;
+        restore_public_dns().await?;
     }
 
     Ok(())