fix: audit pass — WebRTC audit, HTTPS gate, leak compare, kill-switch guard, doc backlog

proxy_chain_manager/firewall.py

@@ -168,7 +168,12 @@ def emergency_disengage() -> None:
     Unlike ``disengage()``, this never raises and does not require prior
     admin check — it simply tries, logs the outcome, and returns.  Safe to
     call from atexit or signal handlers where exceptions must not propagate.
+
+    No-op when our rules are not present (avoids touching firewall policy on
+    every process exit).
     """
+    if not is_engaged():
+        return
     try:
         _set_outbound_policy("blockinbound,allowoutbound")
         _delete_rules()