Matrix: read raw rules that are a match and a verdict

A raw rule that matches and then accepts, drops or rejects (counter and
log allowed, no interfaces) is an exception of every pair of its chain,
shown as "raw: …", instead of unknown; one not for new connections is
skipped like any rule. Interfaces, jumps, NAT, set and verdict maps
stay unknown. The imported IPv6 neighbour discovery rule (hop limit
255) now reads as allowed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/rules.md

@@ -332,6 +332,13 @@ The hits are the rule's packets since housecarld started, in all of its
 traffic: a rule without zones counts for every pair it covers. They are
 how you tell an exception that is used from one that isn't.
 
+A raw rule is read when it is a match followed by `accept`, `drop` or
+`reject` (with `counter` and `log` if you like): it counts as an exception
+for every pair of its chain, shown as `raw: …`. One that matches
+interfaces (the matrix can't tell which zones), jumps, translates, sets
+something or uses a verdict map shows as **unknown**: check it yourself.
+Raw rules have hits only if they say `counter`.
+
 A rule whose addresses all lie in networks directly connected to other
 zones is left out of a pair: traffic between those zones can't have them
 (`from wg_net` doesn't concern traffic coming in on the LAN). Routed