v0.2.0

Features

• Multi-symmetric-uplink: --uplink-iface is now repeatable. Each configured
  uplink gets its own L2 header and ingress-ifindex admission, and the
  reverse leg replies out the SAME physical uplink the client's packet
  arrived on. N=1 (today's single-uplink deployments) is unchanged.
• NODE_ALLOW: outer-Geneve peer-node attestation gate for decap. Populated
  additively (upsert-only) until the controller's own Node LIST is known
  complete (fronts_known), so a cold-started controller never wipes an
  already-pinned peer set on a partial view.
• deploy/'s rp_filter node-prep now runs in a privileged initContainer
  instead of requiring the main container to hold node-wide privileges for
  its whole lifetime.

Hardening

• Two ADRs formalize the trust model this release's features assume: the
  Geneve underlay L2 is not assumed trustworthy (NODE_ALLOW is
  defense-in-depth, not a substitute for a cryptographic underlay like
  WireGuard), and NODE_ALLOW's startup-blackout window is a deliberate
  security-vs-availability tradeoff, not an oversight.
• The k3s e2e rig now deploys and verifies the commit-under-test's image
  :sha, not the DaemonSet's :latest, so cross-node tests catch
  regressions in the actual candidate build.
• The embedded eBPF object is DWARF-stripped, and CI asserts it stays
  stripped, keeping the loader binary's embedded payload lean.

Known limitations

• Asymmetric relay/egress-interface selection is deferred. Replying out
  a different uplink than the one a packet ingressed on is explicitly out
  of scope for this release.
• IPv6 dual-stack is in progress, not shipped. v0.2.0 is IPv4-only, same
  as v0.1.0.
• Single backend per Service, carried over from v0.1.0: multi-endpoint
  load balancing across several ready pods is still not implemented.
• Real-fleet fidelity remains unproven beyond the k3s-on-Lima VM rig,
  carried over from v0.1.0.