macOS clawpatrol run: extension UDP pump swallows the UDP/443 refusal

[piscisaureus]

Follow-up from #839 / #846. The gateway and the Linux daemon now
refuse UDP/443 with ICMP port-unreachable so QUIC clients fall back
to TCP immediately. On macOS clawpatrol run, the Network Extension's
pumpUDP (macos/ClawpatrolExtension/Provider.swift, around the
wg_netstack_recv loop) only handles n > 0 and ignores -1, so a
wrapped process on a Mac still waits out its own QUIC timer before
falling back.

Needs the Swift side to translate the refusal into an error on the
child's socket (or close the flow) the way the Linux daemon does. Not
testable without a Mac; the Linux and WireGuard paths were measured in
#846.