Cilium mTLS ztunnel: Sidecar-Free Encryption Explained

Cilium mTLS via ztunnel doesn't need SPIRE — the old SPIRE-based mutual auth is deprecated. Here's the real migration gotcha: it can silently break L4 NetworkPolicy.