Fix WireGuard plugin reliability

[glafeara]

Summary

• Harden WireGuard import, export, rename, rollback, and signal handling so partial or uncertain NetworkManager operations cannot be reported as successful.
• Make asynchronous IPC acknowledgements truthful, protect editor handoff/save retries, and guarantee a fresh status poll after control operations.
• Keep QR and editor key material in a validated private runtime directory and reap stale crash leftovers safely.
• Correct the Omarchy install/settings documentation, add the default bar section, and bump the plugin to version 2.5.1.
• Add GitHub Actions plus backend, safety, and QML contract regressions.

Root cause

Several subprocess and lifecycle boundaries did not propagate failure reliably. In particular, process-substitution export failures could look successful, import interruption could cross the old/new profile commit boundary, and the UI could acknowledge work that its busy guards had rejected. Secret-bearing QR and editor files also lacked complete crash cleanup.

Impact

Exports no longer produce partial successful output, replacement imports preserve a recoverable profile state, terminal recovery cases do not trigger unsafe editor retries, and IPC callers receive accurate acceptance results. Runtime state and temporary key material are restricted to a validated owner-only directory.

Validation

• bash tests/run.sh — 59 passed
• bash -n backend.sh tests/*.sh tests/fake/*
• omarchy plugin validate .
• git diff --check
• qmllint NamePrompt.qml QrWindow.qml RenameWindow.qml Service.qml