fix: harden sing-box egress rollout

tests/test_packaging.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class PackagingTests(unittest.TestCase):
+    def test_sing_box_drop_in_requires_guard(self) -> None:
+        drop_in = ROOT / "packaging/systemd/sing-box.service.d/10-vpn-egress-guard.conf"
+        text = drop_in.read_text(encoding="utf-8")
+        self.assertIn("Requires=vpn-egress-guard.service", text)
+        self.assertIn("After=vpn-egress-guard.service", text)
+
+    def test_debian_package_installs_sing_box_drop_in(self) -> None:
+        install = (ROOT / "debian/install").read_text(encoding="utf-8")
+        self.assertIn(
+            "packaging/systemd/sing-box.service.d/10-vpn-egress-guard.conf "
+            "usr/lib/systemd/system/sing-box.service.d",
+            install,
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()