Separate control and data logically, move WireGuard into userspace, add a CLI

Corrects the architecture on two points raised in review, while the project
is still small enough to change cheaply.

1. Control and data are separated *logically*, not physically.

The old reading — "nothing but control may ride on iroh" — threw away iroh's
whole value and would have forced the data plane to reimplement STUN, ICE and
a relay. Now both planes ride on iroh with different ALPNs and different
connections, so the data plane inherits hole punching and relay fallback,
while proto/ still knows nothing about packets and dataplane/ knows nothing
about the control protocol.

New boundary: PacketTransport / PacketLink, an authenticated unreliable
datagram channel per (network, peer, protocol). tsunagi/data/1 runs the same
membership handshake, then DataOpen/DataOpenAck, then QUIC datagrams. Only
the smaller endpoint id dials, so exactly one link exists per pair.

A plugin is handed links and never learns reachability, so the WireGuard
announcement shrank to a public key: there is no address left to lie about.

2. WireGuard now runs in userspace, on boringtun's protocol state machine.

No kernel module, no wg tool, no ip shell-out, no loopback proxy: the wgtool,
backend and bridge modules are gone. Only creating a TUN device needs
privileges, and that sits behind TunFactory, so the entire data plane —
handshake, encryption, routing, address ownership — is tested with none.

Address ownership is enforced rather than believed: outbound packets go to
the owner of the destination address, inbound packets are dropped unless
their source is the address derived for the peer that sent them.

3. A `tsunagi` binary: secret, doctor, id, up. It owns the runtime, the
logging subscriber and Ctrl-C, which the library still refuses to.

Also fixes a reference cycle where IrohTransport held Arc<Inner>, which kept
the databases open and the directory lock held after shutdown; two storage
tests caught it once the cycle existed.

81 tests pass offline with no privileges, including real IPv6 packets
crossing a real WireGuard tunnel over real iroh connections. Verified by
hand: two CLI processes forming a mesh both on loopback and via n0 discovery
using only an endpoint id.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/testing.md

@@ -38,18 +38,17 @@ of several system processes, and is not presented as one.
 | 9 | wrong version, a message before authentication, a proof replayed on another connection, an oversized frame and a `Hello` for an inactive network are all rejected without taking the agent down | `tests/authentication.rs` |
 | 10 | a second agent on the same state directory gets a clear error; after a clean stop the directory reopens; shutdown ends background tasks and refuses further work; independent agents coexist in one process | `tests/resilience.rs` |
 
-`tests/wireguard.rs` drives the WireGuard plugin over real iroh connections
-with the in-memory backend: a pair and a three-agent mesh converge to `N - 1`
-peers with locally derived `AllowedIPs`, a departing peer is removed, two
-networks get separate interfaces, keys and overlays, reconciliation repairs a
-configuration edited by hand, a backend failure leaves the control plane
-untouched, a restart keeps the WireGuard identity, shutdown removes every
-interface, a member claiming another member's overlay address is rejected, and
-the core carries the payload without interpreting it.
-
-`tests/wireguard_system.rs` exercises the real `wg`/`ip` backend. It is
-**ignored by default** because it changes the host's network and needs Linux,
-wireguard-tools and `CAP_NET_ADMIN`.
+`tests/wireguard.rs` drives the WireGuard data plane over real iroh
+connections. Everything is real except the packet interface: real agents, real
+control plane, real data links, real WireGuard handshakes and encryption from
+boringtun, with an in-memory TUN device so none of it needs privileges. It
+covers real IPv6 packets travelling both ways through a tunnel, a three-agent
+mesh, a peer that sends from an address it does not own being dropped, packets
+for unowned addresses being counted rather than broadcast, a departing peer
+losing its tunnel, two networks keeping separate interfaces and keys, restart
+keeping the WireGuard identity, shutdown removing every interface, a forged
+overlay claim being rejected, and the core carrying the payload without
+interpreting it.
 
 `tests/discovery.rs` covers the discovery contract itself: a static bootstrap
 candidate is enough to join, several backends compose, entries are withdrawn
@@ -59,15 +58,17 @@ Unit tests in `src/proto/handshake.rs` cover the transcript construction
 itself: role separation, channel binding, identity and network binding,
 unambiguous encoding, and rejection under the wrong key.
 
-Unit tests in `src/dataplane/wireguard/` cover the parts that would otherwise
-need root: key clamping against the RFC 7748 vector, overlay derivation,
-announcement validation including the address-hijack attempt, configuration
-building and rendering, the exact command plan the real backend would run, and
-parsing `wg showconf` and `ip address show` output.
+Unit tests in `src/dataplane/wireguard/` cover key clamping against the RFC
+7748 vector, overlay derivation, announcement validation including the
+address-hijack attempt, interface naming, and IP header parsing against
+truncated and nonsense input.
 
 `tests/end_to_end.rs` is the vertical slice: persistent identity → network
 space → discovery → iroh → authentication → message exchange.
 
+What the default suite does **not** cover is the real TUN interface, because
+that needs `CAP_NET_ADMIN`. Everything above it does run.
+
 ## Not covered, and not claimed to be
 
 Listed in [sync-model.md](sync-model.md#future-tests): snapshots, revocations,