When the target machine is a system container, e.g. in LXD or Incus, this playbook will always remove the wireguard-dkms package and all its dependants, including wireguard, to happily reinstall both in the next step.
Can we imagine to (a) either not care about the presence of wireguard-dkms, e.g. in cases where the Kernel modules are provided by the host system, or (b) find a way to break the link between the two packages, say for RPM- and DEB-based distributions, and to only remove wireguard-dkms, in so the userspace tooling remains available?