Fix sockless TCP keepalive and require complete UTUN initialization

Receive keepalive through the owning ETCP link, preserve RX deadlines, and report routing metrics without TUN. Use independent netlink requests and track installed routes for rollback. Reject incomplete resource initialization and release partially constructed cores while preserving caller config ownership.

Validated startup failure and rollback, padded keepalive, standby, STCP traffic, transport lifecycle, dynamic sockets, and daemon startup. Real TUN/netlink checks passed in an isolated Linux network namespace; modified modules passed FreeBSD compilation checks.

src/tun_linux.c

@@ -188,7 +188,8 @@ int tun_platform_init(struct tun_if* tun, const char* ifname, const char* ip_str
 
     // Set MTU
     if (tun_set_mtu(tun->ifname, mtu) < 0) {
-        DEBUG_WARN(DEBUG_CATEGORY_TUN, "Failed to set MTU %d on %s: %s", mtu, tun->ifname, strerror(errno));
+        DEBUG_ERROR(DEBUG_CATEGORY_TUN, "Failed to set MTU %d on %s: %s", mtu, tun->ifname, strerror(errno));
+        goto fail;
     }
 
     // Bring interface up
@@ -202,15 +203,19 @@ int tun_platform_init(struct tun_if* tun, const char* ifname, const char* ip_str
     tun->ifindex = if_nametoindex(tun->ifname);
     if (tun->ifindex == 0) {
         DEBUG_ERROR(DEBUG_CATEGORY_TUN, "Failed to get ifindex for %s", tun->ifname);
+        goto fail;
     }
 
     // Set non-blocking mode
     int flags = fcntl(tun->fd, F_GETFL, 0);
-    if (flags >= 0) {
-        fcntl(tun->fd, F_SETFL, flags | O_NONBLOCK);
+    if (flags < 0 || fcntl(tun->fd, F_SETFL, flags | O_NONBLOCK) < 0) {
+        DEBUG_ERROR(DEBUG_CATEGORY_TUN, "Failed to set non-blocking mode on %s: %s", tun->ifname, strerror(errno));
+        goto fail;
     }
 
     return 0;
+fail:
+    tun_platform_cleanup(tun); return -1;
 }
 
 // Platform-specific cleanup for Linux