wgtunnel: v4-pin + re-resolve watchdog; FELHOM_WG Critical flips (S4 agent half)

v4-pin (doc 06 §4.2): renderConf takes a pre-resolved IPv4 literal and writes
Endpoint=<ip>:<port> — never the DNS name, never AAAA. Resolver seam (A records
only, LookupNetIP "ip4"); multiple A → lowest (deterministic fleet-wide);
renderConf stays pure. Resolved IP cached: steady-state Apply = zero DNS + zero
execs. DNS failure keeps the last conf (never a teardown).

Watchdog (loop-only, so Apply's zero-exec steady state is untouched): handshake
age > wg_tunnel.stale_after_seconds (default 180) → re-resolve; IP changed →
re-render + restart (endpoint re-IP recovery); IP same → no churn (throttled
warn). Staleness read reuses wg show latest-handshakes (never dump).

Capability: wg-conf-install/enable/restart/handshake-read flipped Critical=true
(backups ride the tunnel from S4); apt-install + disable stay non-critical.
TestWGCapabilityCriticality pins the set.

Tests + red-proofs a/b/d all fire. No new sudoers grant; no wire/JSON change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/config/config.go

@@ -43,9 +43,13 @@ type WGTunnelConfig struct {
 	Enabled         bool   `json:"enabled"`
 	IntervalSeconds int    `json:"interval_seconds"` // reconcile cadence; default 60
 	StateDir        string `json:"state_dir"`        // key/marker/staged-conf under <StateDir>/wg/; default /var/lib/felhom-agent (the FELHOM_WG sudoers install entry hard-codes this default)
+	// StaleAfterSeconds is the handshake-age threshold (S4, doc 06 §4.2) beyond which the manager
+	// re-resolves the endpoint's A record and re-applies on an IP change (endpoint re-IP recovery).
+	// Default 180 (≈ 3× the 25s keepalive → a healthy tunnel never trips it).
+	StaleAfterSeconds int `json:"stale_after_seconds"`
 }
 
-// WithDefaults fills interval + state dir.
+// WithDefaults fills interval + state dir + staleness threshold.
 func (w WGTunnelConfig) WithDefaults() WGTunnelConfig {
 	if w.IntervalSeconds == 0 {
 		w.IntervalSeconds = 60
@@ -53,6 +57,9 @@ func (w WGTunnelConfig) WithDefaults() WGTunnelConfig {
 	if w.StateDir == "" {
 		w.StateDir = "/var/lib/felhom-agent"
 	}
+	if w.StaleAfterSeconds == 0 {
+		w.StaleAfterSeconds = 180
+	}
 	return w
 }