fix7: продакшен-реализация полного reconcile swap и интеграций

- Полностью переписан swap-модуль в режиме exclusive ownership\n- Добавлены verify/checks, статус фактического swap-state и drift\n- Интегрирован ensure-swap в daemon и systemd ExecStartPre\n- Усилен lock API (таймауты) и применение в traffic/firewall/swap\n- Усилен parser firewall (JSON-first + устойчивый text fallback)\n- Обновлены config validation, runtime tools и default priority\n- Синхронизированы docs и build/package hygiene\n- Удалены member Cargo.lock в пользу корневого lockfile

docs/IMPLEMENTATION_SPEC.md

@@ -31,7 +31,7 @@ It does not replace Amnezia. It controls the surrounding system state that the o
 Two systemd services run:
 
 ```bash
-/usr/sbin/awg2-harness daemon --config /etc/awg2-harness/config.toml
+/usr/sbin/awg2-harness --config /etc/awg2-harness/config.toml daemon
 /usr/sbin/awg2-reboot-scheduler --config /etc/awg2-harness/config.toml
 ```
 
@@ -440,7 +440,13 @@ Production reboot path is external binary/service `awg2-reboot-scheduler`:
 - one `/etc/fstab` entry with configured priority;
 - `vm.swappiness = 1` persisted and applied.
 
-The module must be idempotent. It must not delete unknown swap state automatically.
+When `swap.enabled=true`, AWG2 Harness owns host swap state exclusively.
+The desired state is exactly one active swap entry: `swap.path`.
+All other active swap devices/files are disabled via `swapoff`.
+All non-comment swap entries in `/etc/fstab` are removed and replaced by one managed AWG2 entry.
+Regular-file swapfiles that are not the configured `swap.path` may be deleted only after successful `swapoff`.
+Block devices are never deleted, only disabled and removed from fstab.
+The operation must be idempotent.
 
 ## 18. Testing