Security: add nftables input chain to block VMs with netvm="host" from
connecting to host services (only established/related return traffic
allowed). Cap notification active_ids to 1000 entries to prevent
unbounded growth from leaked IDs.
Simplify: replace 4 writeShellScript cleanup wrappers with inline rm,
break up balloond ExecStart one-liner for readability.
Refactor dbus-proxy: extract ConnectionState struct to reduce
run_event_loop from 11 to 6 parameters, add shared pixel format module
(argb_to_rgba/rgba_to_argb) eliminating duplicate conversions in icon.rs
and notifications.rs. Run cargo fmt.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Davíð Steinn Geirsson
75ffcde7f6