fix: routing ip rule missing after reboot, busybox compat, skill restructure

Routing fixes (2026-07-14):
- Add missing ip rule 'from 10.11.13.0/24 lookup 100' to hotplug ifup case
- Add UCI network rule persistence so netifd restores it on boot
- Verify ip rule exists in zt-gateway-switch do_force/do_graceful
- Fix BRIDGE_PORTS auto-detect: use /proc/net/dev instead of broken
  awk-over-ip pipeline (busybox awk mishandles exit in compound if)
- Validate bridge port candidate exists as network interface
- Fix setup-routing: use dev br-zt not dev ztX (ZT iface has no IP
  when enslaved to bridge, causing 'Nexthop has invalid gateway')
- Replace ip rule replace (GNU-only) with del+add for busybox

Infrastructure:
- Fix deploy:install stdin starvation: ssh/scp consume pipe data in
  find|while loop; add </dev/null to prevent truncation
- Move luci-dev skill from root/ to skills/ with .agents/skills/ symlink
- Add policy routing and busybox gotcha sections to SKILL.md
- Add diagnostics doc for the routing fix session

docs/PROGRESS.md

@@ -153,3 +153,42 @@ After installing `luci-compat`, login and page rendering work correctly, but **f
 - ZeroTier requires "Allow Ethernet Bridging" for L2 traffic
 - nftables fw4 zones must explicitly include bridge interfaces
 - Policy routing table 100 must route via exit gateway, not local IP
+## Date: 2026-07-14
+
+## Post-Reboot Routing Fixes
+
+### Problem
+
+After rebooting the production OpenWrt router, WiBLAN clients
+(10.11.13.x) could not route traffic through the active exit
+gateway (Amsterdam, 10.11.12.3). The `ip rule` directing WIBLAN
+traffic to policy table 100 was missing entirely.
+
+### Root Cause
+
+Three gaps in the hotplug/setup-routing/switch pipeline:
+1. Hotplug `ifup` case never installed the `from 10.11.13.0/24` ip rule
+2. UCI persistence wrote routes but not the `network rule` section
+3. `zt-gateway-switch` never verified the rule existed
+
+### Fixes
+
+1. Added ip rule to hotplug heredoc (`zt-gateway-setup`)
+2. Added `network.zt_wiblan_rule` UCI section to `setup-routing` persistence
+3. Added rule verification to `do_force()`/`do_graceful()` in `zt-gateway-switch`
+
+### Additional fixes during the same session
+
+- **BRIDGE_PORTS auto-detect**: Replaced broken awk-over-ip pipeline
+  with UCI lookup + `/proc/net/dev` fallback + interface existence
+  validation (busybox compatibility)
+- **Route dev param**: Changed `dev $BRIDGE_PORTS` to `dev $BRIDGE`
+  in `setup-routing` (ZT interface has no IP when enslaved to bridge)
+- **`ip rule replace`**: Replaced GNU-only `ip rule replace` with
+  `ip rule del` + `ip rule add` for busybox compatibility
+- **Deploy stdin starvation**: Added `</dev/null` to `ssh`/`scp` in
+  `deploy:install` pipe loop
+- **Deploy overwriting UCI**: Noted that `deploy:install` overwrites
+  `/etc/config/zt-gateway` with repo version, clobbering production
+  customizations (e.g. real Amsterdam IP 10.11.12.3 vs placeholder
+  10.99.12.3)