feat!: native F5 VPN backend; remove openconnect (v2.0.0)

[vcwild]

Summary

Breaking change (major, v2.0.0). akon becomes a native, in-process F5 BIG-IP SSL VPN client written in pure Rust. The openconnect delegation is removed entirely — no external VPN binary, no sudo-spawned child, no FFI.

See docs/adr/0002-remove-openconnect-native-f5-is-the-only-backend.md and CHANGELOG.md.

What changed

Native backend (specs 005 + 006)

• F5 protocol stack behind the backend-agnostic VpnBackend boundary: framing (encap + HDLC/FCS16), PPP (LCP/IPCP/IP6CP) negotiation, HTTP auth + XML config, TLS transport, and orchestration.
• Built test-first against an in-memory test-actors framework + byte-exact wire vectors; cross-backend equivalence vs. a SimulatedBackend oracle.
• Production-proven: control plane + data plane validated against a real F5 appliance (connect, full-tunnel, real internal traffic, clean restore).

Rootless runtime

• All TUN/address/route configuration via in-process netlink (no ip/sysctl children) — ADR 0001.
• akon runs as the user with a cap_net_admin+ep file capability. No sudo. Validated in a container as a non-root user.

Safety

• akon vpn off reconciles all host changes (tun, server-pin route, rp_filter, DNS) from a persisted plan — idempotent, works even after a SIGKILL.
• Tests that touch host networking refuse to run outside an isolated netns/container; DNS revert only scheduled when a host-mutating applier actually applied DNS.

Removed

• openconnect_backend, cli_connector, output_parser, openconnect process, connection_event, system_effects, the spawned reconnection daemon.
• The native_backend config flag; openconnect-only error variants.
• Dependencies: which, bindgen, daemonize (+ regex from akon-core).

Tests & CI

• Deleted openconnect-specific suites; coverage moved to native equivalents (lifecycle, auth/tunnel failure, teardown no-op/idempotency, parse helpers).
• CI updated to match the runtime: runs pure + offline native suites with --features test-actors; privileged/online (real-TUN, netns, podman, production sign-off) and real-keyring tests self-skip on runners. clippy now lints the gated test code. continue-on-error removed.

Docs & packaging

• README, Makefile, debian/postinst, rpm/post-install.sh, and release CI updated to the setcap (no-sudo) model.
• All internal ETG domains/IPs sanitized to documentation placeholders (example.com, RFC5737/private ranges); local capture logs purged.

Migration

1. Update akon (or make install).
2. sudo setcap cap_net_admin+ep "$(command -v akon)" (done by packaging/make install).
3. Remove any native_backend = … from config (ignored now); uninstall openconnect.
4. Run without sudo: akon vpn on.

Verification (local, CI-equivalent)

• cargo fmt --check, cargo clippy --workspace --all-targets --features test-actors -D warnings, release build — all clean.
• Full CI-equivalent run (CI=true, no D-Bus, --features test-actors): 36 test binaries, 0 failures.
• ✅ Zero ETG identifiers in any committed file.