feat(clients): add transactional client creation

README.md

@@ -47,3 +47,16 @@ critical rollback error. No M3 mutation command is exposed yet.
 M3 tests use only isolated overrides and deny-by-default command mocks; they do
 not inspect or modify host WireGuard state.
 
+## M4 client creation
+
+`add NAME` creates a client transactionally. The optional forms are
+`--mode full-tunnel|split-tunnel` and `--endpoint HOST`; unknown or extra
+arguments are rejected. Names are restricted to ASCII letters, digits, `.`,
+`_`, and `-` (without a leading `-`). Root is required for production use;
+tests enable only an isolated `WG_MANAGER_TEST_MODE` under `TEST_ROOT`.
+
+Private/public/PSK files, client configuration, and metadata use restrictive
+permissions and are removed if the server transaction or rollback fails.
+Generated key material is supplied to `wg` through stdin or stdout and is not
+placed in command arguments or diagnostic output.
+