What's Changed

Optional containerd host engine (SB_CONTAINER_ENGINE=containerd) — Docker remains the default and byte-identical for existing deployments.

• feat(containerd): Phase 1 engine driver (dark, default docker) by @sumansaurabh in #311
• feat(containerd): Phases 2–4 — CNI/netns, warm pool, gVisor seam by @sumansaurabh in #325
• Ops: install/Ansible/Terraform plumbing, coexistence runbook, AOCR push seam, version pin, soak scenario
• fix(integration): UC-32 private-window assertion vs wildcard-cert ingress by @sumansaurabh in #310
• fix(config): default NetrulesBackend to netlink + setup config defaults docs

Note: v0.7.0 already shipped the cluster inline-only recovery wire-compat break. This tag is the next patch on that line.

Full Changelog: v0.7.0...v0.7.1

What's Changed

• fix(integration): UC-32 private-window assertion vs wildcard-cert ingress (404 = no route) + anti-enumeration check by @sumansaurabh in #310
• fix(containerd): Phase 1 engine driver + review fixes (dark, default docker) by @sumansaurabh in #311
• feat(containerd): Phases 2–4 — CNI/netns, warm pool, gVisor seam by @sumansaurabh in #325

Full Changelog: v0.7.0...v0.7.1