Headless/TUI wrapper around openconnect's native F5 protocol support:
interactive password + OTP login, backgrounds once connected, with
connect/disconnect/status/diag subcommands.

Key behaviors baked in from debugging the IBS VPN:
- Browser User-Agent by default (server serves a JS interstitial to
  openconnect's default UA instead of the real login form).
- vpnc-dns-split wrapper prevents the stock vpnc-script from hijacking
  /etc/resolv.conf with the internal resolver, which breaks public DNS
  (and remote sessions) while connected. Split-DNS to the internal
  resolver is off by default — it refuses queries over the tunnel and
  the names resolve publicly anyway.
- Config read from the invoking user's home (not /root) across sudo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>