Route channel traffic through VPN-region egress — WireGuard, OpenVPN, IKEv2, or a plain SOCKS5 proxy — per channel, no babysitting.