Release 3.8.2.3: cheaper poll I/O, batched macOS sysproxy, no Connect Clone.

Trust corebin cache without Stat; batch networksetup; ActiveProxyURI instead of Config.Clone.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/corebin/cache.go

@@ -1,7 +1,7 @@
 package corebin
 
 import (
-	"os"
+	"strings"
 	"sync"
 )
 
@@ -15,6 +15,11 @@ func CacheKey(binDir, proto string) string {
 	return binDir + "\x00" + proto
 }
 
+// VirtualPath reports paths that are not on-disk binaries (e.g. embedded AWG).
+func VirtualPath(path string) bool {
+	return strings.HasPrefix(path, "embedded-")
+}
+
 // Get returns a cached absolute path if present.
 func Get(key string) (string, bool) {
 	mu.Lock()
@@ -33,22 +38,19 @@ func Set(key, path string) {
 	mu.Unlock()
 }
 
-// Invalidate clears all cached paths (call after EnsureCore / binDir change).
+// Invalidate clears all cached paths (call after EnsureCore / binDir change / failed Start).
 func Invalidate() {
 	mu.Lock()
 	cache = map[string]string{}
 	mu.Unlock()
 }
 
-// Resolve caches the result of fn under key. Stale paths (missing on disk) are refreshed.
+// Resolve caches the result of fn under key.
+// Hot-path polls trust the cache until Invalidate (no per-poll os.Stat).
+// Embedded/virtual paths never touch the filesystem.
 func Resolve(key string, fn func() (string, error)) (string, error) {
 	if path, ok := Get(key); ok {
-		if _, err := os.Stat(path); err == nil {
-			return path, nil
-		}
-		mu.Lock()
-		delete(cache, key)
-		mu.Unlock()
+		return path, nil
 	}
 	path, err := fn()
 	if err != nil {