shunt: add new package

shunt: add new package

shunt is a policy-based routing daemon for OpenWrt. Policies select
traffic by client address or MAC, destination address, domain, port and
protocol, and route it into any netifd interface or device via fwmark
and per-policy routing tables in nftables/fw4.

Domains are covered by a passive DNS observer (AF_PACKET + BPF) that
works with any resolver - dnsmasq, unbound, AGH, a remote DoH client -
because it reads answers on the LAN bridges instead of integrating with
a specific DNS backend. An optional poller pre-warms configured names.
Learned addresses are written in adaptive batches to stay usable beside
packages that keep very large nft sets (e.g. banIP).

Written in ucode, no dependencies beyond ucode modules, nft and ip.
Companion LuCI app is submitted separately to openwrt/luci.

Signed-off-by: Dirk Brenken <redacted>
Co-authored-by: Claude <redacted>
Signed-off-by: Dirk Brenken <redacted>