Fix21: прод-фиксы swap/firewall/wg без легаси

- Swap: допуск небольшой дельты usable size при verify/compare

- Firewall: поддержка Debian 13 dynamic set/add @set вместо только literal meter

- WG: приоритет docker exec для peer/runtime discovery с безопасным fallback

traffic_core/src/swap.rs

@@ -195,7 +195,9 @@ fn disable_foreign_swaps(desired: &DesiredSwap, active: &[ActiveSwap]) -> anyhow
         if entry.name != desired.path {
             run("swapoff", &[entry.name.to_string_lossy().as_ref()])?;
             maybe_delete_foreign_swapfile(entry, &desired.path)?;
-        } else if entry.size_bytes != desired.size_bytes || entry.priority != desired.priority {
+        } else if !active_swap_size_matches(entry.size_bytes, desired.size_bytes)
+            || entry.priority != desired.priority
+        {
             run("swapoff", &[desired.path.to_string_lossy().as_ref()])?;
         }
     }
@@ -428,7 +430,7 @@ fn verify_exclusive_swap_state(desired: &DesiredSwap) -> anyhow::Result<()> {
             desired.path.display()
         );
     }
-    if only.size_bytes != desired.size_bytes {
+    if !active_swap_size_matches(only.size_bytes, desired.size_bytes) {
         anyhow::bail!(
             "swap verify failed: size mismatch {} != {}",
             only.size_bytes,
@@ -490,6 +492,13 @@ fn normalize_ws(s: &str) -> String {
     s.split_whitespace().collect::<Vec<_>>().join(" ")
 }
 
+fn active_swap_size_matches(active_bytes: u64, desired_file_bytes: u64) -> bool {
+    if active_bytes == desired_file_bytes {
+        return true;
+    }
+    active_bytes < desired_file_bytes && desired_file_bytes - active_bytes <= 1024 * 1024
+}
+
 fn run(program: &str, args: &[&str]) -> anyhow::Result<()> {
     let out = Command::new(program).args(args).output()?;
     if !out.status.success() {
@@ -542,6 +551,12 @@ mod tests {
         assert_eq!(got[0].priority, 1);
     }
 
+    #[test]
+    fn active_swap_size_accepts_mkswap_usable_size_delta() {
+        assert!(active_swap_size_matches(2147479552, 2147483648));
+        assert!(!active_swap_size_matches(2146435072, 2147483648));
+    }
+
     #[test]
     fn parse_swapon_rejects_malformed_size() {
         let err = parse_swapon_output("/swapfile file abc 1\n");