Rename the CLI package to tsunagi and its executable to tsng

The command line package is now `tsunagi` and builds the `tsng` executable,
which the packages, the unit, the installers and the workflows install and
run. The core library package becomes `tsunagi-core`, keeping the library name
`tsunagi`, so no code changes `use tsunagi::...`. Directories follow
(crates/tsunagi-core, crates/tsunagi). Every command shown to a person is now
`tsng ...`.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/architecture.md

@@ -69,7 +69,9 @@ And in crates of their own:
 | crate | responsibility |
 |---|---|
 | `tsunagi-wg-quic` | the `wg-quic` protocol: its keys, its announcement, its tunnels |
-| `tsunagi-cli` | the command line agent: the only place that owns a runtime, a logger and signals |
+| `tsunagi` | the command line agent, built as the `tsng` executable: the only place that owns a runtime, a logger and signals |
+
+The core library is the package `tsunagi-core`; its library target is still called `tsunagi`, so code says `use tsunagi::…`.
 
 A protocol is a separate crate so the boundary is the compiler's to enforce,
 and so it can carry its own version. That version is not what peers compare:

docs/broadcast.md

@@ -6,11 +6,11 @@ each member advertises whether it accepts broadcasts over its authenticated
 control session. It is not a network-wide vote or signed shared configuration.
 
 ```sh
-tsunagi join -n games --no-broadcast
-tsunagi join -n games --broadcast
-tsunagi network broadcast games off
-tsunagi network broadcast games on
-tsunagi network broadcast games
+tsng join -n games --no-broadcast
+tsng join -n games --broadcast
+tsng network broadcast games off
+tsng network broadcast games on
+tsng network broadcast games
 ```
 
 Joining without either flag preserves the saved choice. The `network broadcast`
@@ -83,7 +83,7 @@ announcement. A rule left by a crashed run is replaced on the next apply. If
 `iptables` is missing (for example a host with only `nft`) or the process is not
 privileged, the route is still installed and `status` prints a
 `broadcast rules` line saying which half is missing and why. To undo it all,
-turn broadcast off for the network: `tsunagi network broadcast <network> off`.
+turn broadcast off for the network: `tsng network broadcast <network> off`.
 
 **One interface, several networks.** The host has one `255.255.255.255` route
 per interface, so only one overlay address can be its source. The lowest network

docs/exit-node.md

@@ -9,7 +9,7 @@ or Tailscale's exit nodes work. Linux only for now.
 The offering side, per network, off by default:
 
 ```sh
-tsunagi network exit-node <network> on      # or off
+tsng network exit-node <network> on      # or off
 ```
 
 Rules are installed even when the kernel does not forward yet, and `status`
@@ -22,9 +22,9 @@ sudo sysctl -w net.ipv4.ip_forward=1
 The using side:
 
 ```sh
-tsunagi exit-node                  # who offers one
-tsunagi exit-node <name|id>        # send everything through it
-tsunagi exit-node off
+tsng exit-node                  # who offers one
+tsng exit-node <name|id>        # send everything through it
+tsng exit-node off
 ```
 
 The tray does the same: a checkbox on the network tile to offer, and an icon on
@@ -65,7 +65,7 @@ be an exit node in one network and not in another.
   would otherwise cover everything you run. A per-user agent refuses to use an
   exit node and says why.
 - **If the exit node disappears the rules stay** and traffic is dropped until
-  it returns or you run `tsunagi exit-node off`. This is deliberate: falling
+  it returns or you run `tsng exit-node off`. This is deliberate: falling
   back to the direct path would leak traffic nobody agreed to send in the
   clear. The agent logs it once, `status` and the tray say so loudly.
 - **IPv6-only destinations are unreachable** meanwhile; carrying IPv6 through

docs/mainline-dht.md

@@ -1,6 +1,6 @@
 # Mainline rendezvous
 
-`tsunagi up` enables public Mainline DHT discovery. `--no-dht` disables it;
+`tsng up` enables public Mainline DHT discovery. `--no-dht` disables it;
 `--dht` explicitly selects the default. `--reach local` always disables it.
 Manual `--peer` entries work alongside DHT or on their own. Library callers
 opt in with `AgentConfig::with_dht(MainlineDiscovery::default())`; merely
@@ -86,5 +86,5 @@ Public DHT and relay checks are opt-in and are not part of the offline suite.
 Run the optional public check with:
 
 ```sh
-cargo test --locked -p tsunagi --test mainline public_dht_finds_and_authenticates_two_agents -- --ignored --exact
+cargo test --locked -p tsunagi-core --test mainline public_dht_finds_and_authenticates_two_agents -- --ignored --exact
 ```

docs/routing.md

@@ -75,7 +75,7 @@ neither administrative rights nor public relays/DHT.
 Run the forwarding microbenchmark explicitly:
 
 ```sh
-cargo test --release -p tsunagi --lib forwarding_benchmark -- --ignored --nocapture
+cargo test --release -p tsunagi-core --lib forwarding_benchmark -- --ignored --nocapture
 ```
 
 It processes one million 64-byte frames and one million 1280-byte frames with

docs/sync-model.md

@@ -1,6 +1,6 @@
 # Planned state synchronisation
 
-**The first slice of this model is now implemented**, in `crates/tsunagi/src/state/`, and is
+**The first slice of this model is now implemented**, in `crates/tsunagi-core/src/state/`, and is
 used for one thing: IPv4 overlay addresses. What follows describes the whole
 model; the section at the end says exactly which parts exist.
 
@@ -77,7 +77,7 @@ migrations for this.
 
 ## What exists today
 
-Implemented, in `crates/tsunagi/src/state/`:
+Implemented, in `crates/tsunagi-core/src/state/`:
 
 * signed records, one per author per network, each holding that author's
   complete current statement rather than a delta;

docs/testing.md

@@ -89,7 +89,7 @@ The ignored `forwarding_benchmark` measures the synchronous transit routine in
 release mode, excluding crypto and socket I/O. Run it explicitly as described
 in [routing.md](routing.md); it has no timing threshold in the default suite.
 
-Unit tests in `crates/tsunagi/src/state/` cover the signed record model directly: tampering
+Unit tests in `crates/tsunagi-core/src/state/` cover the signed record model directly: tampering
 with any field breaks verification, a newer version wins while an older one
 never rolls back, two authors claiming one address resolve the same way no
 matter the merge order, one key used in two places is reported rather than
@@ -103,7 +103,7 @@ asking a running agent for status over a real Unix socket, joining and
 leaving a network through it, a leftover socket file being replaced while a
 live one is not, and the derived socket path staying short enough to bind.
 
-`crates/tsunagi-cli/tests/network_cli.rs` runs the real binary too: joining
+`crates/tsunagi/tests/network_cli.rs` runs the real binary too: joining
 with no secret invents one, prints it in full and prints a line the other
 side can paste unchanged; a bare name this device already knows resumes
 that network instead of inventing another of the same name; and a network
@@ -114,7 +114,7 @@ duplicate and unknown names change nothing and full ids resolve ambiguity.
 Selector unit tests cover case-sensitive names, Unicode/ellipsis names, copied
 id prefixes and collisions between names and ids without revealing secrets.
 
-`crates/tsunagi-cli/tests/dns_service.rs` runs the real binary: the resolver
+`crates/tsunagi/tests/dns_service.rs` runs the real binary: the resolver
 comes up with no interface to attach it to, the listener is not rebuilt on
 the way past, a name outside every zone is refused, each network gets a zone
 of its own as it is joined, and the resolver can be switched on and off
@@ -128,7 +128,7 @@ about arrive as candidates that still pass the handshake like any other.
 candidate is enough to join, several backends compose, entries are withdrawn
 when a network stops, and a forgotten network stays forgotten across a restart.
 
-Unit tests in `crates/tsunagi/src/proto/handshake.rs` cover the transcript construction
+Unit tests in `crates/tsunagi-core/src/proto/handshake.rs` cover the transcript construction
 itself: role separation, channel binding, identity and network binding,
 unambiguous encoding, and rejection under the wrong key.
 

docs/wireguard.md

@@ -58,7 +58,7 @@ and no second set of NAT problems to solve for WireGuard.
 
 ## Checking it from outside
 
-`tsunagi status` asks a running agent over its local control socket and prints
+`tsng status` asks a running agent over its local control socket and prints
 what it sees, including whether each tunnel has actually handshaken. See
 [../README.md](../README.md#checking-that-it-works).
 
@@ -209,8 +209,8 @@ edit. Reconciliation is purely "do the running tunnels match what is known".
 
 ```bash
 # On both machines: the agent, then the network
-tsunagi up
-tsunagi join --network lab --secret "$SECRET"
+tsng up
+tsng join --network lab --secret "$SECRET"
 ```
 
 See the two-machine walkthrough in [../README.md](../README.md#trying-it-on-two-machines).