cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and
masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets
`defaultroute-metric 0` so the PPPoE route is installed next to the
staging DHCP route instead of being refused. Also makes CrowdSec opt-in
upstream (stellio leaves it off).
The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64
builder without binfmt cannot execute (`--max-jobs 0`); validate the same
YAML with the build host's blocky until the router service carries this.
kurogeek