pr/harden-control-plane-trust-boundary
main
Bound and nonce-bind control responses, reject redirects, and pin session tunnel coordinates so control-plane compromise cannot redirect VPN traffic.