Fix21: прод-фиксы swap/firewall/wg без легаси

- Swap: допуск небольшой дельты usable size при verify/compare

- Firewall: поддержка Debian 13 dynamic set/add @set вместо только literal meter

- WG: приоритет docker exec для peer/runtime discovery с безопасным fallback

traffic_core/src/wg.rs

@@ -21,15 +21,25 @@ pub struct PeerRuntime {
 }
 
 pub fn discover_peers(pid: u32, container: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
-    let boxed: Box<dyn NsTransport> = if nsenter_available() {
-        Box::new(NsenterTransport { pid })
-    } else {
-        Box::new(DockerExecTransport {
-            container: container.to_string(),
-        })
+    let docker = DockerExecTransport {
+        container: container.to_string(),
     };
+    let docker_result = discover_peers_with_transport(&docker, peer_cidr);
+    if let Ok(peers) = &docker_result
+        && (!peers.is_empty() || !nsenter_available())
+    {
+        return docker_result;
+    }
 
-    discover_peers_with_transport(boxed.as_ref(), peer_cidr)
+    if nsenter_available() {
+        let nsenter = NsenterTransport { pid };
+        match discover_peers_with_transport(&nsenter, peer_cidr) {
+            Ok(peers) if !peers.is_empty() => Ok(peers),
+            _ => docker_result,
+        }
+    } else {
+        docker_result
+    }
 }
 
 pub fn discover_peers_with_transport(
@@ -57,14 +67,25 @@ pub fn discover_peer_runtime(
     container: &str,
     peer_cidr: &str,
 ) -> anyhow::Result<Vec<PeerRuntime>> {
-    let boxed: Box<dyn NsTransport> = if nsenter_available() {
-        Box::new(NsenterTransport { pid })
-    } else {
-        Box::new(DockerExecTransport {
-            container: container.to_string(),
-        })
+    let docker = DockerExecTransport {
+        container: container.to_string(),
     };
-    discover_peer_runtime_with_transport(boxed.as_ref(), peer_cidr)
+    let docker_result = discover_peer_runtime_with_transport(&docker, peer_cidr);
+    if let Ok(peers) = &docker_result
+        && (!peers.is_empty() || !nsenter_available())
+    {
+        return docker_result;
+    }
+
+    if nsenter_available() {
+        let nsenter = NsenterTransport { pid };
+        match discover_peer_runtime_with_transport(&nsenter, peer_cidr) {
+            Ok(peers) if !peers.is_empty() => Ok(peers),
+            _ => docker_result,
+        }
+    } else {
+        docker_result
+    }
 }
 
 pub fn discover_peer_runtime_with_transport(