install.sh fetches f5-connect + vpnc-dns-guard into ~/.local/bin from the
GitLab raw-file URLs (/-/raw/<ref>/<file>), seeds the config on first run,
and is idempotent (re-run to update). Supports F5_CONNECT_TOKEN for a
private repo and env overrides for base/ref/bindir. README documents the
one-liner plus a clone+symlink alternative.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The split-DNS feature was unused: this VPN's internal resolver refuses
queries over the tunnel and its names resolve publicly. The wrapper's
only real job is blocking the DNS hijack, so drop the resolvectl
split-DNS path (and VPN_DNS_DOMAINS / F5_DNS_DOMAINS) and rename to
reflect that it's a guard, not a splitter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Headless/TUI wrapper around openconnect's native F5 protocol support:
interactive password + OTP login, backgrounds once connected, with
connect/disconnect/status/diag subcommands.

Key behaviors baked in from debugging the IBS VPN:
- Browser User-Agent by default (server serves a JS interstitial to
  openconnect's default UA instead of the real login form).
- vpnc-dns-split wrapper prevents the stock vpnc-script from hijacking
  /etc/resolv.conf with the internal resolver, which breaks public DNS
  (and remote sessions) while connected. Split-DNS to the internal
  resolver is off by default — it refuses queries over the tunnel and
  the names resolve publicly anyway.
- Config read from the invoking user's home (not /root) across sudo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>