[Seth Juarez (sethjuarez)]

Summary

• bump Python runtime to 2.1.0 and add changelog entry
• bump Rust crates to 2.1.0 and refresh Cargo.lock
• bump TypeScript packages to 2.1.0, refresh package-lock, and finalize changelog
• bump C# packages to 2.1.0 and finalize changelog
• update release manifest versions

Ships the secure-by-default endpoint trust check from #590. It's a minor bump: a new load-time check plus the trustedEndpoints / PROMPTY_TRUSTED_ENDPOINTS opt-out.

Release plan after merge

• release: rust label → the Rust publish workflow creates rust/2.1.0 and publishes the crates
• push signed tags python/2.1.0, typescript/2.1.0, csharp/2.1.0 on the merged release commit

Validation

• TypeScript: npm ci, npm run build, npm run format:check, npm test
• cargo metadata --locked
• dotnet build
• git diff --check