Separate internal WireGuard encryption from data carriers

AWG-only policy also selected a competing end-to-end plugin, so compatible
external links could still have no compatible encrypted data channel. Carrier
changes replaced tunnel state and status selected counters from different
engines. Use one internal WireGuard plugin and a separate DataCarrier contract
for external capabilities/lifecycle. Keep the logical link, keys, handshake,
interface and counter epoch across policy, fallback and direct/relay changes.
Control/discovery transport selection and membership remain independent.

Share the bounded per-neighbour UDP WireGuard engine between ordinary WG and
Amnezia masking. Encrypt the relay envelope inside the outer hop channel with
fresh pair keys/PSK. Remove duplicate WG key/device code and the TCP/TLS inner
cipher. TLS carries opaque internal WireGuard frames. Refuse missing native
transports instead of letting default iroh impersonate their protocol names.
Probe the actual authenticated carrier, independently of the shared IP tunnel;
failed local probe submissions count as loss too.

Apply the vendored iroh interface exclusion to actual direct candidates, not
just public discovery records. Exclude overlay subnets from introductions and
propagate the actual owned interface name, including kernel-assigned utun names,
to every carrier. Production logs showed paths through the overlay itself.
This removes a recursive transport path; it does not establish the historical
cause of the reported 100 GB absolute counter. Exit-node traffic is also real
peer IP traffic even when local applications are idle.

Hide inner cipher choices/handshake clutter in CLI and tray. Report external
routes, readiness and actionable policy/version failures. Count original IP
packets only when their ciphertext is accepted by the logical transport,
including queued packets' exact unpadded lengths. Exclude physical probes and
keepalives. Export counter epochs; sum per-peer rate deltas and discard stale
histories so joins/restarts cannot turn old totals into fresh traffic. Status
also prints exact IP byte totals for comparison with the tray.

Coordinated upgrade: data ALPN 6, internal wireguard-e2e capability v4,
wg/awg v2, QUIC carrier v1, TLS v2, local IPC v23. Control ALPN 8, device/network
identity derivation, signed records and saved network choices stay unchanged.
Keep the historical wg-quic key store; transactionally import missing keys from
wg then awg without replacing canonical keys. Forget removes legacy copies too,
on the blocking pool, to prevent resurrection after restart. Preserve historic
cipher options as shared settings, rejecting contradictory values.

Validation on Linux in the Nix development shell:
- cargo fmt --all -- --check
- cargo clippy --locked --workspace --all-targets -- -D warnings
- cargo test --locked --workspace --all-targets (562 passed, 3 ignored)
The inherited service socket/secret/group environment overrides were removed
for isolated CLI process tests. A new carrier test initially raced the first
peer announcement; its deadline polling now waits for a peer row explicitly.
Real loopback endpoints, membership, SQLite, WG/AWG/TLS encryption and memory
TUNs cover mixed-carrier relaying and one smoltcp TCP connection surviving
relay/direct/policy changes and a dropped transmission. Counter tests check
exact plaintext lengths, refused sends, epochs, joins and stale histories.
Public DHT, privileged kernel and manual benchmark tests remain ignored;
macOS/Windows native TUNs, desktop GUI and WAN/DPI behavior were not run.

docs/testing.md

@@ -185,7 +185,8 @@ validation. Tests are offline; public STUN/DPI/NAT effectiveness needs separate
 real-network validation.
 
 Runtime protocol selection tests switch real AWG and iroh/QUIC carriers and
-end-to-end WireGuard tunnels from either endpoint-id role, carry full-size
+external policies from either endpoint-id role while preserving the one internal
+WireGuard tunnel, key, handshake and counter epoch, carry full-size
 packets, keep another active network's tunnels unchanged, disable and re-enable
 the data plane without losing control sessions, and preserve selection after
 restart. CLI tests use a real agent process and control socket to exercise
@@ -225,8 +226,8 @@ to test the entire mesh inside these namespaces.
 
 Devices-window tests render the egui grid at multiple widths with its real
 scroll area. They check stretching and shrinking without an expanding first
-column, separate handshake/control RTT values, unknown measurements and short
-end-to-end hints that do not substitute the carrier protocol. This does not
+column, control RTT without internal handshake/protocol clutter, unknown measurements
+and data readiness/error hints. This does not
 establish native desktop rendering on every platform.
 
 
@@ -252,3 +253,22 @@ widths, click a diagram backend, and distinguish the new-flow selection from
 traffic on an existing binding. Sampling checks cover idle open flows, stale
 observations, counter resets, recreated listeners and removal of cached
 histories. These are headless egui checks, not native desktop screenshots.
+
+`tsunagi-wg-quic/tests/carriers.rs` uses the same internal WireGuard plugin over
+real ordinary WG UDP and TCP/TLS, with loopback address selection and memory
+TUNs. Exact original IP byte/packet counts exclude health probes and encryption
+overhead. The AWG suite connects AWG-only and QUIC-only endpoints through a
+mixed relay. One real smoltcp TCP connection stays established through relay →
+direct QUIC → a dropped packet with all local carriers off → AWG relay; both
+middle TUNs and endpoint keys are checked. This exercises a real userspace TCP
+stack, not a host SSH server. Legacy key migration tests cover missing keys,
+canonical precedence, idempotence and damaged source files.
+
+Candidate tests exercise the vendored iroh local address filter on real bound
+endpoints and exclude overlay subnets from introductions. A renaming memory TUN checks
+that carriers receive the actual interface name, as required for macOS utun.
+A missing native WG transport is refused rather than silently carried by QUIC. Tray traffic tests
+cover a joining peer with 100 GB of prior counters, departed peers, removed
+networks and new counter epochs, including resets hidden by growth in the other
+direction. These distinguish rates from absolute volumes; they do not establish
+the cause of an earlier unrecorded high absolute counter on a real host.