lx: gate reserved-byte clear on receive so AmneziaWG magic survives

The Cloudflare "reserved" bytes (1-3) were zeroed unconditionally on
every received datagram across all StdNetBind/WinRingBind receive paths.
AmneziaWG reads its magic header as LittleEndian.Uint32(packet[padding:])
where padding is s1/s2/s4; with small padding (0-3) the magic overlaps
bytes 1-3, so clearing them collapses it out of the ranged h1-h4 window
and every packet is dropped (handshake included) — the AWG endpoint
never comes up. Plain WG (types 1-4, bytes 1-3 already zero) and large
padding are unaffected, which is why it went unnoticed.

Gate all five receive clears (bind_std receiveIP, msgx_darwin
receiveSingle + makeReceiveMsgX, bind_windows receiveIPv4/v6) behind a
new hasReserved() so bytes 1-3 are only touched when a WARP reserved
value is actually configured. Send paths already gate on a per-endpoint
loaded/non-zero check, so they are left unchanged. The reserved map is
populated before the receive goroutines start and never mutated after,
so the lock-free read is safe.

Tests: awg_stdnetbind_reserved_lx_test.go brings up two Devices over
StdNetBind with zero padding (magic in bytes 0-3) and asserts delivery
(red before the fix, green after); reserved_gate_lx_test.go pins the
hasReserved() gate.

device/obf_guards_test.go

@@ -23,8 +23,8 @@ func TestParseObfLen(t *testing.T) {
 		{"0", 0, false},
 		{"100", 100, false},
 		{fmt.Sprintf("%d", MaxMessageSize), MaxMessageSize, false},
-		{"-1", 0, true},                               // would panic slice bounds in Obfuscate
-		{fmt.Sprintf("%d", MaxMessageSize + 1), 0, true}, // would OOM the handshake make
+		{"-1", 0, true}, // would panic slice bounds in Obfuscate
+		{fmt.Sprintf("%d", MaxMessageSize+1), 0, true}, // would OOM the handshake make
 		{"2000000000", 0, true},
 		{"abc", 0, true},
 	}