Add bundled WireGuard diagnostics and application proxy

client/scripts/build-tunnel-go.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+client_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+target_triple=$(rustc -vV | sed -n 's/^host: //p')
+case "$target_triple" in
+  aarch64-apple-darwin) go_os=darwin; go_arch=arm64 ;;
+  x86_64-apple-darwin) go_os=darwin; go_arch=amd64 ;;
+  x86_64-unknown-linux-gnu) go_os=linux; go_arch=amd64 ;;
+  aarch64-unknown-linux-gnu) go_os=linux; go_arch=arm64 ;;
+  *) echo "Unsupported Go tunnel build target: $target_triple" >&2; exit 1 ;;
+esac
+
+mkdir -p "$client_dir/src-tauri/binaries"
+(
+  cd "$client_dir/tunnel-go"
+  GOOS="$go_os" GOARCH="$go_arch" CGO_ENABLED=0 go build -trimpath \
+    -o "$client_dir/src-tauri/binaries/opsx-tunnel-go-$target_triple" .
+)
+echo "Built Go WireGuard tunnel component for $target_triple"