Add NetBSD support (pi0, pi1) via userspace wireguard-gomain

NetBSD has no native wg(4) kernel module and no wg-quick; pi0/pi1 use
pkgsrc wireguard-go + wg instead, with a custom /etc/rc.d/wireguard
script since there's nothing to hook into. This required:

- Generating a stripped config (no Address/DNS lines) for `wg setconf`,
  which rejects wg-quick extensions with "Line unrecognized".
- Generating the rc.d script itself, with one route add/delete pair per
  peer AllowedIPs prefix, since wg-quick normally manages those routes
  automatically and wg only handles the crypto routing decision.
- Per-host wg_bin override (doas resets PATH to exclude /usr/pkg/bin) and
  full-path chown in the NetBSD install path (doas PATH also excludes
  /usr/sbin, where chown lives on NetBSD -- caught by actually running
  --install against pi0 before fixing it here).

Verified: --generate output for pi0/pi1 matches the hand-written configs
byte-for-byte (same keys, same routes); --install deployed cleanly to
both with correct root:wheel ownership and live WireGuard handshakes;
non-NetBSD hosts (f0, r0, blowfish, earth) produce byte-identical output
to before this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions