Switch verify() to validate the real config tree (interface -> prefix) instead of non-existent rule nodes.
This enforces:
- mode interface requires prefix ... interface
- non-interface modes must not set prefix ... interface
- referenced interface exists when mode is interface