fix(core): nfqws segfault, trap cleanup, strategy name extraction

- install_nfqws.sh: strip LTO and --gc-sections flags from Makefile before
  build to prevent segfault on some systems; verify binary runs before install
- lib/functions.sh: check_nfqws() now also tests --help to catch segfaulting
  or missing-dependency binaries
- run_strategy.sh: replace broken single-quoted trap string with proper
  cleanup_tmp function so temp file is actually removed
- service.sh: extract strategy name by stripping general_ prefix from
  wrapper filename so ExecStart points to correct config

Fixes: nfqws segfault on build, service start failure, temp file leak.

lib/functions.sh

@@ -122,6 +122,16 @@ check_nfqws() {
         echo ""
         return 1
     fi
+    # Verify the binary actually runs (catches segfaults/missing deps)
+    if ! "$BIN_DIR/nfqws" --help >/dev/null 2>&1; then
+        echo ""
+        print_red "ERROR: nfqws binary exists but does not run (segfault? missing deps?)"
+        echo ""
+        echo "Try rebuilding:"
+        echo "  ./install_nfqws.sh"
+        echo ""
+        return 1
+    fi
     return 0
 }