The image is the same pinned debian:13.7-slim svc-net-tor and svc-db-openldap
build from. The interpreter is the controller's, which carries the mesh CLI's
dependencies; the managed /usr/local/bin/python3 does not.
The consolidated svc-net-wireguard role, its requirement document and the three
references that only existed to support it go away together: the lint ignore for
a load failure inside its tasks, the requirements index entry, and the tunnel
subnet variable nothing else consumed.
Left in place deliberately: the WireGuard mention in the svc-net category
description, which is upstream prose about networking roles in general rather
than anything this role owned.
Replaces the linuxserver-image harness with a deploy-driven one: 01_bootstrap (6 empty containers + make install + DinD), 02_registration (per-host dedicated inventory via 'inventory provision' + full-mesh wg0.conf), 03_handshake ('deploy dedicated --id svc-net-wireguard' per host + all-pairs check). Adds the role's inventory-driven config path (mounts a per-host wg0.conf). NAT-flavor coverage follows once the mesh is green.
tests/ -> files/test/ (test.sh/local.sh/external.sh/mesh.sh) + templates/test.env.j2 (the test-e2e-cli discovery marker). README and requirement 026 updated to the adopted contract.
evangelostsak