macOS strong jail

It has been a real PITA to make `pf` in macOS reliably filter/proxy traffic for just one process due to limitations in where group selectors can be used. See also macOS's official statement "[Packet Filter is not API](https://developer.apple.com/documentation/technotes/tn3165-packet-filter-is-not-api#Overview)". There's a modern macOS swift API called [`NETransparentProxyProvider`](https://developer.apple.com/documentation/networkextension/netransparentproxyprovider).

The complexity of that approach includes:
* Getting the appropriate entitlements from Apple
* Including some Swift in the build toolchain

And, I'm unsure whether the UX would be truly seamless.