Drop foreign sources without a gateway return route

IPv6 router translated every public address in its block to mesh; WG Mesh now delivers foreign-source packets only when the VM has a gateway route back.