chore: drop dead code and the stale wireguard-tools dependency [P2]

wireguard-tools was still declared in Depends and in the runtime package list installed by
tools/build.sh --prepare-runtime-env. Since peer discovery moved to docker exec, no code
path invokes a host-side wg, and check_host_tools stopped requiring it. The declaration
was therefore installing a package the harness never calls and misrepresenting the actual
architecture to anyone reading the control file. Removed from both places.

Three items were carrying #[allow(dead_code)], which is a way of silencing the compiler
about a real question rather than answering it:

- SysctlTuningStatus.desired duplicated data that is already in .current - every
  SysctlValue holds both the desired and the current value, so the second Vec was the same
  information cloned on every inspect call and read by nobody;
- SysctlValue.managed was always set to true and never read. Ownership is decided per file
  by the marker, not per key, so the field encoded nothing;
- unix_now() in the reboot scheduler, along with the SystemTime and UNIX_EPOCH imports it
  needed. The module works in chrono NaiveDateTime throughout.

All three are removed rather than annotated. The workspace now builds clean under
-D warnings with no dead_code exceptions anywhere.

cargo test --workspace: 158 + 4 passed. clippy -D warnings clean.

docs/ACCEPTANCE_CHECKLIST.md

@@ -177,6 +177,7 @@
 - [ ] Пакет не устанавливает `/etc/awg2-harness/config.toml` автоматически.
 - [ ] Пакет не включает/не стартует сервис автоматически.
 - [ ] Пакет не имеет `Depends`/`Recommends` на `docker.io`; установка Amnezia/Docker внешняя.
+- [ ] Пакет не имеет `Depends` на `wireguard-tools`: peer state читается внутри контейнера, host-side `wg` не используется.
 - [ ] `apt install ./awg2-harness_<version>_amd64.deb` не устанавливает и не заменяет Docker.
 - [ ] `apt install ./awg2-harness_<version>_amd64.deb` проходит на clean Debian 13 Amnezia host.
 - [ ] После ручной установки config `awg2-harness validate-config` проходит.

reboot_module/src/main.rs

@@ -1,10 +1,4 @@
-use std::{
-    fs,
-    path::PathBuf,
-    process::Command,
-    thread,
-    time::{Duration as StdDuration, SystemTime, UNIX_EPOCH},
-};
+use std::{fs, path::PathBuf, process::Command, thread, time::Duration as StdDuration};
 
 use anyhow::Context;
 use chrono::{Duration, NaiveDateTime, NaiveTime, Timelike, Utc};
@@ -188,14 +182,6 @@ fn parse_hhmm(v: &str) -> anyhow::Result<NaiveTime> {
     NaiveTime::from_hms_opt(h, m, 0).ok_or_else(|| anyhow::anyhow!("bad time"))
 }
 
-#[allow(dead_code)]
-fn unix_now() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs()
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

tools/build.sh

@@ -37,7 +37,6 @@ BUILD_PACKAGES=(
 
 RUNTIME_PACKAGES=(
   iproute2
-  wireguard-tools
   nftables
   kmod
   util-linux
@@ -355,7 +354,7 @@ Section: net
 Priority: optional
 Architecture: amd64
 Maintainer: AWG2 Harness
-Depends: libc6, iproute2, wireguard-tools, nftables, kmod, util-linux, procps, systemd
+Depends: libc6, iproute2, nftables, kmod, util-linux, procps, systemd
 Description: Host-side orchestrator for AmneziaWG traffic shaping and lifecycle recovery
  AWG2 Harness manages AmneziaWG traffic shaping, IFB ingress shaping,
  nftables anti-torrent guard, reboot scheduling, swap setup and daemonized

traffic_core/src/sysctl_tuning.rs

@@ -19,9 +19,9 @@ pub struct SysctlTuningStatus {
     pub modules_load_matches: bool,
     pub bbr_available: Option<bool>,
     pub bbr_active: Option<bool>,
+    /// Each entry carries both the desired and the current value, so a separate desired
+    /// list would be the same data twice.
     pub current: Vec<SysctlValue>,
-    #[allow(dead_code)]
-    pub desired: Vec<SysctlValue>,
     pub drift_reason: Option<String>,
     pub warnings: Vec<String>,
 }
@@ -31,8 +31,6 @@ pub struct SysctlValue {
     pub key: String,
     pub desired: Option<String>,
     pub current: Option<String>,
-    #[allow(dead_code)]
-    pub managed: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -109,7 +107,6 @@ pub fn inspect_sysctl_tuning(cfg: &Config) -> anyhow::Result<SysctlTuningStatus>
                 bbr_available: None,
                 bbr_active: None,
                 current: Vec::new(),
-                desired: Vec::new(),
                 drift_reason: Some(format!("render plan unavailable: {e}")),
                 warnings: vec![format!("render plan error: {e}")],
             });
@@ -136,7 +133,6 @@ pub fn inspect_sysctl_tuning(cfg: &Config) -> anyhow::Result<SysctlTuningStatus>
             key: k.clone(),
             desired: Some(v.clone()),
             current: read_sysctl(k).ok(),
-            managed: true,
         });
     }
 
@@ -201,8 +197,7 @@ pub fn inspect_sysctl_tuning(cfg: &Config) -> anyhow::Result<SysctlTuningStatus>
         modules_load_matches,
         bbr_available: plan.bbr_available,
         bbr_active: plan.bbr_active,
-        current: values.clone(),
-        desired: values,
+        current: values,
         drift_reason,
         warnings: plan.warnings,
     })