torad --wireguard-config brings up a WireGuard tunnel entirely in user
space and confines all torrent traffic to it. No sudo, no wg-quick, no
kernel module, no host setup.
Adds passt, wireguard-go and iproute2 to the dev environment; torad
execs all three at runtime.