fix: routing ip rule missing after reboot, busybox compat, skill restructure

Routing fixes (2026-07-14):
- Add missing ip rule 'from 10.11.13.0/24 lookup 100' to hotplug ifup case
- Add UCI network rule persistence so netifd restores it on boot
- Verify ip rule exists in zt-gateway-switch do_force/do_graceful
- Fix BRIDGE_PORTS auto-detect: use /proc/net/dev instead of broken
  awk-over-ip pipeline (busybox awk mishandles exit in compound if)
- Validate bridge port candidate exists as network interface
- Fix setup-routing: use dev br-zt not dev ztX (ZT iface has no IP
  when enslaved to bridge, causing 'Nexthop has invalid gateway')
- Replace ip rule replace (GNU-only) with del+add for busybox

Infrastructure:
- Fix deploy:install stdin starvation: ssh/scp consume pipe data in
  find|while loop; add </dev/null to prevent truncation
- Move luci-dev skill from root/ to skills/ with .agents/skills/ symlink
- Add policy routing and busybox gotcha sections to SKILL.md
- Add diagnostics doc for the routing fix session

skills/TODO.md

@@ -0,0 +1,22 @@
+# E2E Test Implementation Checklist
+
+## Done
+- [x] Fix `docker-compose.yml` tab corruption (line 21)
+- [x] Fix Dockerfile to be buildable from base image via `podman build --security-opt seccomp=unconfined`
+- [x] Update `luci-dev` skill with podman build learnings
+
+## In Progress
+- [ ] Update `mise.toml` `docker:up` task to use `podman build` before `docker compose up -d`
+- [ ] Start stack with freshly built image and verify containers stay up
+- [ ] Verify end-to-end:
+  - `curl` ubus login returns a session ID
+  - `curl` `zt-gateway.status` returns `active_gateway: amsterdam`, `active_ip: 10.99.12.3`
+  - `curl` `zt-gateway.switch` to `tirunelveli`/`force` succeeds (mock gateway is reachable)
+
+## Pending
+- [ ] Write `e2e/login.spec.ts`
+- [ ] Write `e2e/overview.spec.ts`
+- [ ] Write `e2e/switch.spec.ts`
+- [ ] Write `e2e/drain.spec.ts`
+- [ ] Write `e2e/health.spec.ts`
+- [ ] Run tests serially and verify they pass