- dns/router: add r.closing guard in registerRuleSetCallbacks to
prevent callback leak when Close() races with Start() in daemon path
- adapter/inbound: validate addr.IsValid() in DNSResponseAddresses
before appending to guard against zero-RDATA DNS records
- adapter/rule: add evaluate to non-final actions in IsFinalAction
