Why does Cilium enforce policy by identity rather than by IP address?

Why this is the answer

Pod IPs are ephemeral and recycle rapidly, so IP-based rules churn and explode in number; a label-derived identity is stable and scales with workloads, not pods. eBPF can absolutely read IP headers, the K8s API does allow ipBlock, and encryption is independent of whether a rule is identity- or IP-based.