fix(network): preserve multipart WireGuard peer dumps#1503

Summary

Linux can split one WireGuard peer across dump messages. The pinned reader replaces the first fragment with the continuation, losing its endpoint and some AllowedIPs. Upgrade to defguard 0.8.0, the first released fix, and migrate its four API differences.

This prerequisite fixes installed-peer reads. Mesh retention follows in a separate PR.

Evidence

• Refreshed onto current main without force-push. Independent review returned SHIP for each updated layer. The combined refreshed tree passed 607 Rust unit tests, the multipart kernel regression, Clippy with warnings denied, the uninstall contract, formatting, and whitespace checks. Fix round 1 then changed the mesh firewall and WireGuard reset in #1504, so the mesh source no longer matches the live-tested version. The two-Machine live runs below predate that round.
• The same decoder and real kernel dump lose the endpoint on 0.7.1 and preserve it on 0.8.0.
• cargo test -p ployzd --test network_namespace wireguard_multipart_dump_preserves_peer -- --ignored --exact --nocapture passes. It checks the endpoint, keepalive, and all 1,024 AllowedIPs.
• Existing network tests, Clippy with warnings denied, formatting, and whitespace checks pass. The earlier CI volume receive failure was reproduced in the unchanged fake ZFS fixture; the independent fixture fix is #1505. Refreshed-head CI is pending.

Merge danger

Door: Two-way. No persisted Ployz format changes.

Blast radius: Networking. The upgrade adds mandatory Unix dependencies. Runtime verification covers Linux; non-Linux builds were not checked.