fix: accept Windows firewall loopback readback

lime-rs/crates/tool-runtime/src/windows_firewall.rs

@@ -305,6 +305,8 @@ mod platform {
             // Windows Firewall COM read-back expands the IPv6 any-address
             // into an explicit range while preserving the same address set.
             "::-::" => "::".to_owned(),
+            // The same API expands this IPv4 CIDR into its dotted netmask.
+            "127.0.0.0/255.0.0.0" => "127.0.0.0/8".to_owned(),
             _ => value,
         }
     }
@@ -337,6 +339,14 @@ mod platform {
             ));
         }
 
+        #[test]
+        fn csv_comparison_accepts_windows_ipv4_netmask_readback() {
+            assert!(same_csv_values(
+                "127.0.0.0/255.0.0.0, ::/127",
+                "127.0.0.0/8,::/127"
+            ));
+        }
+
         #[test]
         fn offline_rules_cover_loopback_and_non_loopback_ranges() {
             assert_eq!(RULES.len(), 2);