Wireguard: support userspace mode (Rootless Android/Termux)

[dpurnam]

Description

This PR fixes Newt running in userspace WireGuard environments
(e.g. Termux on a non-root Android).

Problem:

• dev.Up() fails with "permission denied"
• ICMP-based health checks always fail
• Tunnel never becomes usable despite UDP connectivity working

Solution:

• Introduce TRUE_USERSPACE_WG=1
• Skip dev.Up() when running in userspace mode (for ex. rootless androids or termux)
• Do not treat initial ICMP ping failure as fatal in userspace mode

Verified working:

• Android (Termux, non-root)
• Pangolin endpoint reachable
• Sites and Resources successfully created and accessible

Reference:
#161 (comment)

Additional Comments:
sing-box WireGuard works in the same environment when system=false, which matches this change.

How to test?

export TRUE_USERSPACE_WG=1;
newt --id .... --secret ....

OR simply use an arg --true-userspace-wg with newt command

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

[oschwartz10612]

Hi! Thanks for the PR!

I am a little confused how this fixes things because dev.Up() should be occurring in the netstack network stack all in newt and not on the host. Newt should / can be run without sudo. I am kind of shocked it still works without bringing up the internal device.

Would you be able to let me know what kind of errors you were experiencing prior to this fix?

[dpurnam]

Hi! Thanks for the PR!

I am a little confused how this fixes things because dev.Up() should be occurring in the netstack network stack all in newt and not on the host. Newt should / can be run without sudo. I am kind of shocked it still works without bringing up the internal device.

Would you be able to let me know what kind of errors you were experiencing prior to this fix?

#161 (comment)

and

#161 (comment)