Fix21: прод-фиксы swap/firewall/wg без легаси

- Swap: допуск небольшой дельты usable size при verify/compare

- Firewall: поддержка Debian 13 dynamic set/add @set вместо только literal meter

- WG: приоритет docker exec для peer/runtime discovery с безопасным fallback

traffic_core/src/firewall.rs

@@ -234,7 +234,7 @@ fn inspect_firewall(transport: &dyn NsTransport, cfg: &Config) -> anyhow::Result
     let hook_forward_present = nt.contains("hook forward");
     let policy_accept_present = nt.contains("policy accept");
     let ct_state_new_present = nt.contains("ct state new");
-    let meter_present = nt.contains("meter awg2_peer_connlimit_v4");
+    let meter_present = connlimit_state_present(&nt);
     let counter_name_used = nt.contains("counter name antitorrent_dropped_v4");
     let drop_present = nt.contains(" drop");
 
@@ -470,7 +470,7 @@ fn firewall_drift_reason(actual: &FirewallActual) -> String {
         return "missing ct state new".to_string();
     }
     if !actual.meter_present {
-        return "missing nft meter".to_string();
+        return "missing nft meter/dynamic set".to_string();
     }
     if !actual.counter_name_used {
         return "missing nft counter name usage".to_string();
@@ -496,12 +496,19 @@ fn firewall_rule_contract_matches(table: &str, cidr: &str, max_conn: u32) -> boo
         && table.contains("policy accept")
         && table.contains(&needle_cidr)
         && table.contains("ct state new")
-        && table.contains("meter awg2_peer_connlimit_v4")
+        && connlimit_state_present(&table)
         && table.contains(&needle_max)
         && table.contains("counter name antitorrent_dropped_v4")
         && table.contains("drop")
 }
 
+fn connlimit_state_present(table: &str) -> bool {
+    table.contains("meter awg2_peer_connlimit_v4")
+        || (table.contains("set awg2_peer_connlimit_v4")
+            && table.contains("flags dynamic")
+            && table.contains("add @awg2_peer_connlimit_v4"))
+}
+
 fn normalize_nft_text(input: &str) -> String {
     input
         .replace(['\n', '\t', '{', '}', ';', ',', '"'], " ")
@@ -633,6 +640,27 @@ table inet awg2_harness {
         assert!(firewall_rule_contract_matches(table, "10.8.1.0/24", 100));
     }
 
+    #[test]
+    fn nft_rule_contract_accepts_debian13_dynamic_set_rendering() {
+        let table = r#"
+table inet awg2_harness {
+  counter antitorrent_dropped_v4 {
+    packets 0 bytes 0
+  }
+  set awg2_peer_connlimit_v4 {
+    type ipv4_addr
+    size 65535
+    flags dynamic
+  }
+  chain forward_antitorrent {
+    type filter hook forward priority filter; policy accept;
+    ip saddr 10.8.1.0/24 ct state new add @awg2_peer_connlimit_v4 { ip saddr ct count over 100 } counter name "antitorrent_dropped_v4" drop
+  }
+}
+"#;
+        assert!(firewall_rule_contract_matches(table, "10.8.1.0/24", 100));
+    }
+
     #[test]
     fn host_firewall_parser_tolerates_quoted_lo_and_ipv6_icmp_alias() {
         let table = r#"