I finally got WireGuard to work the way I want it to work. It's now properly dual stack and assigns public IPv6 to clients. No NAT66.