feat(wgtunnel): render operator OOB /32 into wg-felhom AllowedIPs (H1 Part 1, [OF-1])

renderConf appends a validated, deterministically-SORTED oob_peer_ip /32 so the
operator peer survives self-heal/restart (a runtime wg set was wiped by self-heal).
WireWireguard gains oob_peer_ip (omitempty — absent = byte-identical pre-H1 conf).
Non-hollow tests: sorted+byte-stable, lower-IP-sorts-first, absent-identical,
invalid/v6 rejected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/hub/report.go

@@ -357,6 +357,13 @@ type WireWireguard struct {
 	Endpoint   WireWireguardEndpoint `json:"endpoint"`
 	Pubkey     string                `json:"pubkey"`      // the box's registered pubkey
 	AssignedIP string                `json:"assigned_ip"` // e.g. "10.77.0.2/32"
+
+	// OOBPeerIP is the operator OOB peer's tunnel address (bare IPv4, e.g. "10.77.0.250", TASK H1).
+	// When set, the agent appends it as a second /32 to the box's wg-felhom AllowedIPs so packets the
+	// endpoint forwards FROM the operator are accepted — RENDERED into the conf (not a runtime `wg
+	// set`) so it survives self-heal/restart/reboot ([OF-1]: a runtime widening was wiped by the
+	// agent's own self-heal). `omitempty`: absent = OOB off, byte-identical conf for pre-H1 hosts.
+	OOBPeerIP string `json:"oob_peer_ip,omitempty"`
 }
 
 // WireWireguardEndpoint is the endpoint half of the wireguard block.