Implement the WireGuard data plane plugin

The first IP plugin, built on the data plane boundary the core already had.

Plugin:
- one X25519 key per network in the plugin's own wireguard.sqlite, separate
  from the iroh identity and from the network secret; a damaged store is an
  error, never a silently regenerated identity
- deterministic IPv6 ULA overlay: every member derives the same /64 from the
  network id and its own /128 from its WireGuard public key, so no
  coordinator allocates addresses
- AllowedIPs are derived locally, never taken from a peer's announcement, so
  a member cannot claim another member's overlay address; a mismatched claim
  is rejected
- bounded, versioned, validated announcement carried as the existing opaque
  capability payload, which the core still never parses
- each agent builds its own full-mesh configuration (N-1 peers) and
  reconciles on every change and on a timer, repairing drift
- WireguardBackend abstraction: RecordingBackend in memory, and WgToolBackend
  driving real wg/ip on Linux, split into a pure planner plus parsers and a
  thin executor so everything interesting is testable without root

Core, three generic additions the plugin needed:
- IpPlugin::on_network_activated, so per-network state is ready before peers
- PluginContext for re-announcements and error reports from plugin tasks,
  with errors counted by the owning network runtime
- IpPlugin::shutdown, awaited with a grace period, so system objects go away

94 tests pass offline with no privileges: 35 new WireGuard unit tests and 12
integration tests over real iroh connections. The real wg/ip backend needs
root and is behind --ignored in tests/wireguard_system.rs; it was not run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/wireguard_system.rs

@@ -0,0 +1,120 @@
+//! Opt-in tests for the real `wg` / `ip` backend.
+//!
+//! These are the only tests in this repository that change the host's network,
+//! so they are **ignored by default** and are not part of the standard suite.
+//!
+//! They need Linux, the `wireguard` kernel module, `wg` from wireguard-tools,
+//! `ip` from iproute2, and `CAP_NET_ADMIN` (in practice: root):
+//!
+//! ```text
+//! sudo -E cargo test --test wireguard_system -- --ignored --test-threads=1
+//! ```
+//!
+//! Everything they exercise — the command plan, the parsers, the configuration
+//! builder and reconciliation — is already covered without root by the unit
+//! tests in `src/dataplane/wireguard/` and by `tests/wireguard.rs`. What these
+//! add is confirmation that the plan the planner produces is one the real
+//! tools accept.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::net::SocketAddr;
+
+use tsunagi::dataplane::wireguard::wgtool::WgToolBackend;
+use tsunagi::dataplane::wireguard::{
+    Cidr, InterfaceParams, WgSecretKey, WireguardBackend, build_interface, overlay_address,
+};
+use tsunagi::identity::{NetworkKeys, NetworkName, NetworkSecret};
+
+/// A name unlikely to collide with anything already on the host.
+const TEST_INTERFACE: &str = "tsunagitest0";
+
+fn test_network() -> tsunagi::NetworkId {
+    NetworkKeys::derive(
+        &NetworkName::new("system-test").unwrap(),
+        &NetworkSecret::from_bytes(vec![11u8; 32]).unwrap(),
+    )
+    .network_id()
+}
+
+#[test]
+#[ignore = "changes the host's network; needs Linux, wg, ip and CAP_NET_ADMIN"]
+fn the_real_backend_applies_reads_back_and_removes_a_configuration() {
+    let backend = WgToolBackend::new().expect("the wg-tools backend should be available on Linux");
+    let network = test_network();
+    let local = WgSecretKey::generate();
+    let peer = WgSecretKey::generate().public();
+
+    // Start from a clean slate even if a previous run was interrupted.
+    backend.remove(TEST_INTERFACE).unwrap();
+    assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), None);
+
+    let desired = build_interface(
+        InterfaceParams {
+            network,
+            name: TEST_INTERFACE.to_string(),
+            private_key: local.clone(),
+            listen_port: 51899,
+            mtu: Some(1380),
+            keepalive: Some(25),
+        },
+        [peer],
+        |_| Some("10.99.0.2:51899".parse::<SocketAddr>().unwrap()),
+    );
+
+    backend.apply(&desired).unwrap();
+
+    let observed = backend
+        .inspect(TEST_INTERFACE)
+        .unwrap()
+        .expect("the interface should exist after apply");
+    assert_eq!(observed.public_key, local.public());
+    assert_eq!(observed.listen_port, 51899);
+    assert_eq!(observed.peers.len(), 1);
+    assert_eq!(observed.peers[0].public_key, peer);
+    assert_eq!(
+        observed.peers[0].allowed_ips,
+        vec![Cidr::host(overlay_address(network, &peer))]
+    );
+    assert!(
+        observed
+            .addresses
+            .contains(&Cidr::host(overlay_address(network, &local.public()))),
+        "the overlay address should be assigned: {:?}",
+        observed.addresses
+    );
+
+    // Applying the same configuration again must be a no-op, not a rebuild.
+    backend.apply(&desired).unwrap();
+    assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), Some(observed));
+
+    backend.remove(TEST_INTERFACE).unwrap();
+    assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), None);
+    // Removing something that is not there is not an error.
+    backend.remove(TEST_INTERFACE).unwrap();
+}
+
+#[test]
+#[ignore = "changes the host's network; needs Linux, wg, ip and CAP_NET_ADMIN"]
+fn the_real_backend_refuses_an_interface_it_did_not_create() {
+    let backend = WgToolBackend::new().expect("the wg-tools backend should be available on Linux");
+    let name = "tsunagitest1";
+
+    // A plain dummy link, not a WireGuard device: something that belongs to
+    // somebody else.
+    let created = std::process::Command::new("ip")
+        .args(["link", "add", "dev", name, "type", "dummy"])
+        .status()
+        .expect("ip should be available");
+    assert!(created.success(), "could not create the dummy link");
+
+    let result = backend.inspect(name);
+    let _ = std::process::Command::new("ip")
+        .args(["link", "del", "dev", name])
+        .status();
+
+    assert!(
+        result.is_err(),
+        "an interface the plugin did not create must be refused, not adopted"
+    );
+}