Just need to clarify in case someone reads this and thinks it won't work for them- in a PM with Alex today he said that Netclient DOES look for (and use) the app store version of Wireguard, and only wants the Brew version if it isn't installed. This means there's probably something wrong with my setup and I'll have another look.