chore: tie loose ends — wiring, imports, gitignore, dep audit

.gitignore

@@ -21,3 +21,5 @@ signup_draft.json
 *.png
 *.jpg
 *.jpeg
+# Exceptions — keep bundled assets that are already tracked
+!proxy_chain_manager/world_map.png

docs/OPERATOR_RUNBOOK.md

@@ -36,6 +36,15 @@ Restart-Service -Name MpsSvc -Force
 This resets all runtime firewall state (not persistent rules).  You may still
 need to remove the `PCM_*` rules afterward with Option 1.
 
+### How the application handles this automatically
+
+`firewall.py` exposes `emergency_disengage()`, which is registered via
+`atexit` and `signal.SIGTERM`/`SIGINT` in `service.py`.  A clean exit or
+SIGTERM will call `emergency_disengage()` automatically, removing all
+`PCM_*` rules and restoring `allowoutbound` before the process terminates.
+Only a hard kill (`SIGKILL`, power loss, BSOD) can bypass this handler —
+in those cases use Option 1 or Option 2 above.
+
 ### Verify rules are gone
 
 ```powershell