Register the managed interface, periodic reconciler, configd action, outbound NAT, UDP port exemption, and availability-dependent fail-open or fail-closed rules.
Create plugin-owned WireGuard, interface, and gateway objects, then retain healthy servers or reconcile through eligible recommendations until a handshake succeeds.
Add the package metadata and OPNsense model for country eligibility, native traffic selectors, direct egress, failure policy, and managed object identity.
