v2.1.0-rc1

2.1.0-rc1 (September 28, 2026) BREAKING CHANGES: cli: Migrated the consul connect redirect-traffic command from iptables / ip6tables to nftables ( nft ). The command now uses the sdk/nftables package, which applies all IPv4 and IPv6 rules atomically in a single pass via the nftables inet address family, instead of separate iptables and ip6tables invocations. [ GH-23785 ] cli: Transparent proxy exclusions are now validated before rules are applied: user IDs must be numeric and outbound exclusions must be IP addresses or CIDRs.