Story 4.1 — Post-poll validation: nft hash diff, tc no-filters, per-category liveness

**Epic:** #740 — Validation, rollback & observability

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §11 (Validation and rollback).

After each poll-loop tick, validate live state before declaring it good.

**Acceptance criteria:**
- nft check: hash/diff `nft list table inet weaver` against the expected rendered ruleset; mismatch → fail.
- tc check: enumerate `$VETH`/`$EGRESS` classes and assert zero tc filters present (a present filter indicates a stale alternative layer).
- liveness probe: a synthetic/observed packet per category (CN/partner/public/peer-BN) lands in the expected class within ~10 s.