Transport.Run spawned an untracked goroutine, and Close only closed the socket
without waiting for it. An in-flight onInbound could therefore derive and store a
PSK after the manager cleared the peer, or call SetPresharedKey while the
WireGuard interface was being torn down.
Track the receive goroutine and make Close drain it (close the socket to unblock
the read, then wait for the callback to return). Manager.Stop now closes and
drains the transport before clearing the exchange and PSK maps, and the engine
tears WireGuard down only after Stop returns, so no late callback repopulates
cleared state or touches a closed device.
Found in cubic review on #7098 (client/internal/pqkem_transport.go:61).
riccardom
4eba98d561