chore: release v0.1.0

[github-actions]

🤖 New release

• outpost: 0.0.8 -> 0.1.0

Changelog

0.1.0 - 2026-08-31

Fixed

• (wstunnel) reset reconnect backoff after a healthy session
• (dashboard) show uptime in place of launch time
• (dashboard) display computed AWS proxy uptime

Other

• (dashboard) serialize TunnelStats directly for the stats API
• (cloudformation) dedup the instance-pointing DNS A record
• (aws) select newest NixOS AMI with max_by instead of sort
• (aws) detect a missing stack by error code, not debug string
• hoist invariant resource count out of stack event loop
• drop unused demo-mode example constructors
• drop unused process-status query methods
• replace wireguard with wstunnel
• update readme
• enable ec2 proxy to terminate tls
• address some clippy lints
• improve bandwidth limiting
• aws proxy finally works
• initial cloudfront support
• create AWS debugging mode
• Relicense

Changed

• Replaced the WireGuard transport with wstunnel reverse tunnels. The origin no
  longer needs NET_ADMIN, iptables, tc, or kernel modules; traffic accounting
  and bandwidth limits are now enforced by an in-process relay.
• All configuration is via CLI arguments (with OUTPOST_* env fallbacks); the
  ingress URL scheme (tcp://, udp://, tls://) now drives behavior:
  tls:// ingresses are terminated on the frontend with Let's Encrypt.
• Per-ingress origin ports via --ingress tcp://host:80?origin-port=8080 and
  --origin-host replace the old --origin endpoint.
• The dashboard is now opt-in at runtime (--dashboard [addr]) and the
  dashboard cargo feature is no longer a default.
• --use-cloudfront became --cdn and now provisions an ACM viewer
  certificate, aliases, managed cache policies, and a dedicated
  origin-<host> DNS name (requires us-east-1).
• The cloudflare frontend supports multiple hostnames and no longer panics on
  cloudflared failures.
• Docker image is now built from a pinned nixpkgs toolchain and ships as a
  minimal FROM scratch rootfs bundling wstunnel and cloudflared.

Removed

• WireGuard support, --enable-tls, --regions (single --region now), and
  the --access-key-id/--secret-access-key flags (the AWS SDK credential
  chain is used instead).

---

This PR was generated with release-plz.