Merge origin/main into feature/svc-net-wireguard

Brings in 225 commits, including the merged web-app-openbao work and the
LMStudio loopback fix.

Seven conflicts:

- The legacy svc-net-wireguard-core/plain/firewalled roles this branch deleted
  in e706170a0 were modified upstream. The deletion stands, which is the whole
  premise of the branch.
- The MCP audit takes upstream's list plus svc-net-firewall, with the three
  legacy wireguard entries collapsed into the single svc-net-wireguard: 23.
- web-app-openbao/README.md takes main's reviewed version wholesale.
- matrix.py takes both sides: upstream's app_id argument to _reset_credentials
  and this branch's _write_mesh call after it.

The merge pushed matrix.py to 511 lines against the 500 cap, so the step
runner moved to utils/tests/swarm/run.py, which is self-contained and leaves
matrix.py at 427. Its test moved with it.

tests/unit/python/utils/tests/swarm/test_run_reporting.py

@@ -3,7 +3,7 @@ import io
 import unittest
 from unittest import mock
 
-from utils.tests.swarm import matrix
+from utils.tests.swarm import run
 
 
 class TestRunReporting(unittest.TestCase):
@@ -18,10 +18,10 @@ class TestRunReporting(unittest.TestCase):
     def _run_capturing(self, rc: int) -> tuple[int, str]:
         buffer = io.StringIO()
         with (
-            mock.patch.object(matrix, "_run_watched", return_value=rc) as watched,
+            mock.patch.object(run, "run_watched", return_value=rc) as watched,
             contextlib.redirect_stdout(buffer),
         ):
-            returned = matrix._run(["true"], env={"A": "b"}, label="demo phase")
+            returned = run.run_step(["true"], env={"A": "b"}, label="demo phase")
         watched.assert_called_once_with(["true"], env={"A": "b"})
         return returned, buffer.getvalue()