talm apply: extend declared-resource walker to StaticHostConfig / NetworkRuleConfig / WireguardConfig references #192

The pre-apply walker that talm apply runs to verify declared host-resource references covers links and disks but does not cover three multidoc kinds that carry host-resource-shaped fields:

• StaticHostConfig.address — could be sanity-checked as a reachable IP / hostname.
• NetworkRuleConfig.matchSourceAddress — network selectors, not host-resource refs strictly, but a CIDR typo here is operator-impactful.
• WireguardConfig.peers[].endpoint — peer endpoint resolves to host/IP, not a link or disk on the local node.

All three were intentionally left out because they fall outside the strict "host resource declared in config exists on host" contract that the existing walker enforces. But they're operator-actionable defects (a typo in a Wireguard peer endpoint is silent until the tunnel doesn't come up) and the walker is the natural place to surface them.

Scope: extend pkg/applycheck/refs.go::multidocHandlers with handlers for the three kinds, define their finding shapes in pkg/applycheck/validate.go, add contract tests for each. Real-cluster validation needs to confirm Talos's own validation overlap is acceptable — Talos likely already rejects a malformed Wireguard endpoint at apply time, in which case the walker's value is "fail before the apply RPC".

Could grow further: TimeServerConfig.servers, ResolverConfig.servers, ProxyConfig endpoint — every multidoc kind with a "reachable network endpoint" field.