autofix: correct ingress and egress policies

Previously, the egress policy was of the form:

  (filter vlan = egress; vlan := 1) | id

This had the effect of both ejecting packets from the network, and
allowing them remain in the network. At the next hop they would have
been elminated, so this was technically correct, but at the cost of
duplicating all traffic, which is unacceptable. The new policy is this:

  (filter vlan = egress; vlan := 1) | (filter not(vlan = egress); id)

This will ensure that egress packets are ejected and not duplicated,
while leaving internal packets unchanged.
autofix: Fix bug in branchy(TP, S) case

The Alt constructor was hardcoded. It should have been using the `cr`
constructor that's passed to rpc_branchy.
autofix: fix branchy(NL, NL) case

This is a much simpler and correct implementation, and corresponds to to
distribution laws of parallel composition and choice.

Related to #152
Add testtables example.
Update tables-failover example.