feat(safety): add atomic WireGuard mutation and rollback engine

tests/mocks/bin/flock

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+command_name=${0##*/}
+: "${TEST_MOCK_LOG:?TEST_MOCK_LOG must identify the isolated test log}"
+printf '%q' "$command_name" >>"$TEST_MOCK_LOG"
+for argument in "$@"; do printf ' %q' "$argument" >>"$TEST_MOCK_LOG"; done
+printf '\n' >>"$TEST_MOCK_LOG"
+[[ $# == 2 && $1 == -n && $2 =~ ^[0-9]+$ ]] || exit 99
+if [[ -n ${MOCK_FLOCK_CHANGE_TO:-} && -z ${MOCK_FLOCK_CHANGED_MARKER:-} && -f $MOCK_FLOCK_CHANGE_TO && -n ${WG_MANAGER_CONFIG:-} ]]; then
+  cp -- "$MOCK_FLOCK_CHANGE_TO" "$WG_MANAGER_CONFIG"
+  export MOCK_FLOCK_CHANGED_MARKER=1
+fi
+if [[ ${MOCK_FLOCK_BUSY:-0} == 1 ]]; then exit 1; fi
+if [[ ${MOCK_FLOCK_FAIL:-0} == 1 ]]; then exit 97; fi
+exit 0