Ok - so that works - I'm not entirely satisfied because it feels like there should be a more elegant solution.
I had to give up on putting the wireguard on the lan side of the firewall. This means that my wireguard configuration is just like the openwrt doc
This means that from the wireguard server side (my home network) - when I tried to connect back over the wireguard connection - I am blocked because the OpenWRT firewall doesn't have port 22 exposed. Unlike when I'm connected to the OpenWRT device via wireless and I can ssh to the router itself.
This is easy to fix with a firewall rule DANGER DANGER
config redirect
option dest 'lan'
option target 'DNAT'
option name 'OpenWRT ssh'
list proto 'tcp'
option src 'wan'
option src_dport '22'
option dest_ip '10.133.32.1'
option dest_port '22'
Where 10.133.32.1 is the IP of my OpenWRT router.
DO NOT DO THIS if your OpenWRT router is your direct connection to the internet. This allows traffic from the WAN side to see ssh.
In my case - the router is already behind another router (because that is my LTE connection).
In the end, while this is ugly - it is a simple solution. Simple is good.