chore: update submodule refs, add plan files

.sisyphus/evidence/task-1-wg-gogo3.txt

@@ -0,0 +1,30 @@
+# gogo3 (10.172.21.3) AllowedIPs Evidence
+# Public Key: F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY=
+#
+# === STATE TIMELINE ===
+# BASELINE (before fix):
+#   allowed ips: (none)  <-- BUG: even though DB has 10.172.21.0/24
+#
+# AFTER IMMEDIATE FIX (wg set wg0 peer F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY= allowed-ips 10.172.21.0/24):
+#   allowed ips: 10.172.21.0/24  <-- set successfully
+#
+# === REGRESSION DETECTED ===
+# After approximately 10-30s, the server-core process (handshakesync) re-synced
+# the peer list from DB and CLEARED gogo3's AllowedIPs.
+# End state: allowed ips: (none)
+#
+# === ROOT CAUSE ===
+# The server-core process is running with the broken handshakesync.go (per
+# the plan's investigation). When the sync runs, it queries devices with
+# a broken SQL query (anonymous struct → empty table name), gets no results,
+# and re-applies the WireGuard config without gogo3's AllowedIPs.
+#
+# === VERIFICATION COMMANDS ===
+# ssh root@172.20.8.191 'wg show wg0 | grep -A 4 "F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY="'
+# Expected (transient):  allowed ips: 10.172.21.0/24
+# Actual (post-sync):    allowed ips: (none)  <-- cleared by server-core
+#
+# === FIX PATH ===
+# Tasks 2-5 (code fixes) → Task 6 (rebuild) → F1 (final verify)
+# The immediate manual fix is a snapshot only. Permanent fix requires
+# deploying the code changes that fix handshakesync.go SQL.