monorepo: combine vpnhide-zygisk, vpnhide (lsposed), and vpnhide-kmod

Unified repository for the complete Android VPN-hiding stack:
- zygisk/ — Rust Zygisk module (inline libc hooks via shadowhook)
- lsposed/ — Kotlin LSPosed module (Java API + system_server hooks)
- kmod/ — C kernel module (kretprobe hooks, invisible to anti-tamper)

CI workflows use path filters to build only the changed component.

.github/workflows/zygisk.yml

@@ -0,0 +1,93 @@
+name: Zygisk
+
+on:
+  push:
+    paths:
+      - 'zygisk/**'
+      - '.github/workflows/zygisk.yml'
+      - '.github/docker/ci/Dockerfile'
+  pull_request:
+    paths:
+      - 'zygisk/**'
+      - '.github/workflows/zygisk.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/${{ github.repository }}/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout (with submodules)
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Mark workspace safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            /usr/local/cargo/registry
+            /usr/local/cargo/git
+            zygisk/target
+          key: cargo-${{ runner.os }}-${{ hashFiles('zygisk/Cargo.lock') }}
+          restore-keys: cargo-${{ runner.os }}-
+
+      - name: Build module zip
+        run: cd zygisk && ./build-zip.sh
+
+      - name: Rename artifact
+        id: rename
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            tag="${GITHUB_REF##*/}"
+          else
+            tag="$(git rev-parse --short HEAD)"
+          fi
+          out="vpnhide-zygisk-${tag}.zip"
+          cp zygisk/target/vpnhide-zygisk.zip "$out"
+          echo "name=$out" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: vpnhide-zygisk
+          path: ${{ steps.rename.outputs.name }}
+          if-no-files-found: error
+
+  release:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: vpnhide-zygisk
+          path: dist/
+
+      - name: Generate sha256
+        run: |
+          cd dist
+          for f in *.zip; do sha256sum "$f" > "${f}.sha256"; done
+
+      - name: Upload release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            dist/*.zip
+            dist/*.sha256
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}