fix: explicitly activate protection profiles

[UglyEgg]

Problem

The WireGuard protection helper adds a profile and waits for a device-added signal. Adding a profile does not guarantee activation when autoconnect is no longer eligible. After a manual device disconnect, NetworkManager can retain an inactive profile; startup then waits indefinitely and retries can add more profiles.

NetworkManager documents that adding an unsaved profile starts it only when autoconnect is eligible, while activate_connection_async explicitly starts the connection and returns an NMActiveConnection whose state tracks final activation:

• https://networkmanager.dev/docs/api/latest/gdbus-org.freedesktop.NetworkManager.Settings.html
• https://networkmanager.dev/docs/libnm/latest/NMClient.html#nm-client-activate-connection-async

Change

• Explicitly activate newly added profiles.
• Reuse only existing profiles whose normalized settings match the request, apart from UUID and timestamp.
• Reuse an already active or activating matching profile without duplication.
• Observe NMActiveConnection.state through activation completion.
• Propagate add/activation failures and retire cancellables and signal handlers after completion or timeout.
• Preserve mismatched, unrelated, and uncertain profiles; do not delete or weaken protection rules.

Verification

• 18 focused cases use real libnm settings and fake NetworkManager I/O. They cover inactive, activating, active, duplicate, mismatched, failed, cancelled, timeout, autoconnect-race, and late-callback paths.
• The retained-inactive-profile regression fails against pristine upstream and passes with this change.
• Complete upstream suite: 485 passed; two unchanged dependency warnings.
• Flake8 passes on both changed files.
• Downstream Fedora 44 acceptance reproduced a retained inactive protection profile after manual disconnect, then verified single-profile recovery and ordinary connect/disconnect behavior with the equivalent patch.

Development disclosure: I developed this patch with material assistance from OpenAI Codex under my direction, then reviewed, tested, and signed the final change.