Create plugin-owned WireGuard, interface, and gateway objects, then retain healthy servers or reconcile through eligible recommendations until a handshake succeeds.
Add the package metadata and OPNsense model for country eligibility, native traffic selectors, direct egress, failure policy, and managed object identity.
