Add runtime Tor-egress self-check (fail-closed) for Nostr relays

Runtime-verified whether Apple's URLSession honors connectionProxyDictionary
SOCKS settings for Nostr relay traffic (plain HTTPS + URLSessionWebSocketTask),
since the app routes all Nostr traffic through Arti's local SOCKS5 proxy solely
via those keys and Apple does not officially support SOCKS for URLSession on iOS.

Verification harness (scripts/tor-egress-verification/): a minimal SOCKS5 CONNECT
proxy that logs arriving connections, plus a Swift probe that runs an HTTPS GET
and a WebSocket ping through a URLSession configured with the proxy dict. Result:
on macOS (kCFNetworkProxiesSOCKS* constants) and the iOS simulator (raw
"SOCKSProxy"/"SOCKSPort" string keys, the exact app path) BOTH HTTP and WebSocket
are proxied, do remote DNS through the proxy, and the proxied session is
fail-closed (every request errors when the SOCKS proxy is down). The feared
direct-egress leak did not reproduce on the tested platforms.

Defense-in-depth for the platform Apple does not guarantee (physical iOS):
add TorEgressVerifier, which performs a canary request through the proxied
session and asserts the exit is a Tor node (check.torproject.org IsTor==true),
positively detecting a direct egress even if the OS silently ignored the proxy.
Policy: verifiedTor allows (cached for a TTL); notTor refuses (leak detected,
never open relays); unreachable allows-with-warning (session stays fail-closed
by construction). Wired into TorManager.awaitEgressReady() and required by both
NostrRelayManager and GeoRelayDirectory before opening connections. Cache is
invalidated on Tor restart/dormant/shutdown. Never falls back to a direct
connection.

Probe is injected so the policy/caching is unit-tested offline; the live-network
harness lives under scripts/ and is not run by CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

localPackages/Arti/Sources/TorManager.swift

@@ -59,6 +59,14 @@ public final class TorManager: ObservableObject {
     private var socksReady: Bool = false { didSet { recomputeReady() } }
     private var restarting: Bool = false
 
+    /// Runtime egress self-check: proves the proxied session actually exits via
+    /// Tor before relay connections are opened (defense-in-depth against a
+    /// platform silently ignoring the SOCKS proxy). Cached for a few minutes.
+    public let egressVerifier = TorEgressVerifier(
+        ttl: 300,
+        probe: TorEgressVerifier.liveProbe()
+    )
+
     // Whether the app must enforce Tor for all connections (fail-closed).
     public var torEnforced: Bool {
         #if BITCHAT_DEV_ALLOW_CLEARNET
@@ -125,6 +133,22 @@ public final class TorManager: ObservableObject {
         return await MainActor.run(body: { self.networkPermitted })
     }
 
+    /// Like `awaitReady`, but additionally requires that a canary request
+    /// through the proxied session positively verifies Tor egress. Returns
+    /// `false` if Tor never became ready, or if the egress self-check
+    /// positively detected a non-Tor (direct) egress. Callers must fail closed
+    /// on `false` — never fall back to a direct connection.
+    nonisolated
+    public func awaitEgressReady(timeout: TimeInterval = 75.0) async -> Bool {
+        let ready = await awaitReady(timeout: timeout)
+        guard ready else { return false }
+        // Clearnet dev builds don't route through Tor, so the canary would
+        // (correctly) report non-Tor; skip it there.
+        let enforced = await MainActor.run { self.torEnforced }
+        guard enforced else { return true }
+        return await egressVerifier.verify()
+    }
+
     // MARK: - Filesystem
 
     func dataDirectoryURL() -> URL? {
@@ -325,6 +349,8 @@ public final class TorManager: ObservableObject {
             self.socksReady = false
             self.isStarting = false
         }
+        // Force a fresh egress self-check once Tor comes back.
+        Task { await egressVerifier.invalidate() }
     }
 
     public func shutdownCompletely() {
@@ -353,6 +379,7 @@ public final class TorManager: ObservableObject {
                 // Note: Don't clear startedAt here - it will be set fresh on next startIfNeeded()
                 // Clearing it here races with startup and defeats the grace period
             }
+            await self.egressVerifier.invalidate()
         }
     }
 
@@ -368,6 +395,8 @@ public final class TorManager: ObservableObject {
             self.isDormant = false
             self.lastRestartAt = Date()
         }
+        // New Arti instance means new circuits; re-verify egress after restart.
+        await egressVerifier.invalidate()
 
         _ = arti_stop()