remove the swarm wireguard mesh; tombstone its options

nix/packages/default.nix

@@ -95,22 +95,18 @@ let
         install -Dm755 ${workspaceBuild}/bin/${bin} $out/bin/${bin}
       '';
 
-  # Operator CLI — extractor plus shell completions and the `wg`
-  # wrapper. Suitable for `nix profile install .#hivectl` /
+  # Operator CLI — the binary plus shell completions. Suitable for
+  # `nix profile install .#hivectl` /
   # `environment.systemPackages = [ …packages.<system>.hivectl ]`
   # when the operator only wants the admin CLI.
   # Completions come from the binary's own `completions <shell>` verb
   # (the single source of truth, so they never drift from the actual
-  # verbs). The wireguard-tools wrap makes `hivectl wg` subcommands
-  # work before `deploy.wireguard.enable` is set (wg init is the very
-  # first setup step). Completion generation runs before wrapProgram
-  # since wrapProgram renames the real binary.
+  # verbs).
   hivectlPkg =
     pkgs.runCommand "hivectl"
       {
         nativeBuildInputs = [
           pkgs.installShellFiles
-          pkgs.makeWrapper
         ];
         meta = {
           description = "hyperhive operator CLI";
@@ -123,16 +119,13 @@ let
           --bash <("$out/bin/hivectl" completions bash) \
           --zsh <("$out/bin/hivectl" completions zsh) \
           --fish <("$out/bin/hivectl" completions fish)
-        wrapProgram "$out/bin/hivectl" \
-          --prefix PATH : ${pkgs.wireguard-tools}/bin
       '';
 
   # Per-bin split packages. Agent containers depend on the individual
   # bins they actually exec/PATH-need (see nix/agent-modules/packages.nix)
   # instead of the `default` bundle — that keeps `hivectl` (dials the *host*
-  # admin socket, unreachable from inside a container, drags in
-  # `wireguard-tools`) and redundant binaries out of every agent's
-  # closure.
+  # admin socket, unreachable from inside a container) and redundant
+  # binaries out of every agent's closure.
   binPkgs = lib.mapAttrs mkBinPackage daemonBins // {
     hivectl = hivectlPkg;
   };