ci: use AOSP clang in Docker image, fix kmod build

- Add Google's AOSP clang (clang-r487747c, same as Pixel kernel build)
  to the CI Docker image via sparse checkout. Distro clang caused ABI
  mismatches leading to bootloops on device.
- Update kmod workflow to use the Docker image + AOSP clang instead of
  system clang from apt.
- Replace symvers with real vmlinux.symvers from Pixel kernel build
  (8050 symbols vs 4060 from device .ko extraction).
- Add kmod build deps (bc, kmod, cpio, binutils-aarch64) to Docker image.

.github/workflows/kmod.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - 'kmod/**'
       - '.github/workflows/kmod.yml'
+      - '.github/docker/ci/Dockerfile'
   pull_request:
     paths:
       - 'kmod/**'
@@ -13,32 +14,38 @@ on:
 
 permissions:
   contents: write
+  packages: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/${{ github.repository }}/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
     strategy:
       matrix:
         gki:
           - branch: android14-6.1
             symvers: kmod/symvers/android14-6.1.symvers
 
+    env:
+      CLANG_DIR: /opt/aosp-clang/bin
+
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-              bc kmod clang lld llvm \
-              binutils-aarch64-linux-gnu
+      - name: Mark workspace safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: Cache kernel source
         uses: actions/cache@v4
         id: kernel-cache
         with:
           path: kernel-source
-          key: kernel-${{ matrix.gki.branch }}-v1
+          key: kernel-${{ matrix.gki.branch }}-v2
 
       - name: Clone kernel source (shallow)
         if: steps.kernel-cache.outputs.cache-hit != 'true'
@@ -52,35 +59,53 @@ jobs:
           cd kernel-source
 
           make ARCH=arm64 LLVM=1 LLVM_IAS=1 \
+              CC=$CLANG_DIR/clang LD=$CLANG_DIR/ld.lld \
+              AR=$CLANG_DIR/llvm-ar NM=$CLANG_DIR/llvm-nm \
+              OBJCOPY=$CLANG_DIR/llvm-objcopy \
+              OBJDUMP=$CLANG_DIR/llvm-objdump \
+              STRIP=$CLANG_DIR/llvm-strip \
               CROSS_COMPILE=aarch64-linux-gnu- \
               gki_defconfig
 
           touch abi_symbollist.raw
 
           make ARCH=arm64 LLVM=1 LLVM_IAS=1 \
+              CC=$CLANG_DIR/clang LD=$CLANG_DIR/ld.lld \
+              AR=$CLANG_DIR/llvm-ar NM=$CLANG_DIR/llvm-nm \
+              OBJCOPY=$CLANG_DIR/llvm-objcopy \
+              OBJDUMP=$CLANG_DIR/llvm-objdump \
+              STRIP=$CLANG_DIR/llvm-strip \
               CROSS_COMPILE=aarch64-linux-gnu- \
               olddefconfig prepare || true
 
-          clang -E -Wp,-MD,scripts/.module.lds.d -nostdinc \
-              -I arch/arm64/include -I arch/arm64/include/generated \
-              -I include -I include/generated \
-              -include include/linux/kconfig.h \
-              -D__KERNEL__ -DCC_USING_PATCHABLE_FUNCTION_ENTRY \
-              --target=aarch64-linux-gnu -x c scripts/module.lds.S \
-              2>/dev/null | grep -v '^#' > scripts/module.lds
-          sed -i 's/((1UL) << 12)/4096/g' scripts/module.lds
+          # Generate module.lds (make prepare sometimes skips this)
+          if [ ! -f scripts/module.lds ]; then
+              $CLANG_DIR/clang -E -Wp,-MD,scripts/.module.lds.d -nostdinc \
+                  -I arch/arm64/include -I arch/arm64/include/generated \
+                  -I include -I include/generated \
+                  -include include/linux/kconfig.h \
+                  -D__KERNEL__ -DCC_USING_PATCHABLE_FUNCTION_ENTRY \
+                  --target=aarch64-linux-gnu -x c scripts/module.lds.S \
+                  2>/dev/null | grep -v '^#' > scripts/module.lds
+              sed -i 's/((1UL) << 12)/4096/g' scripts/module.lds
+          fi
 
           cp "$GITHUB_WORKSPACE/${{ matrix.gki.symvers }}" Module.symvers
 
-          PLACEHOLDER="6.1.999-placeholder-$(printf 'x%.0s' $(seq 1 100))"
-          echo "#define UTS_RELEASE \"$PLACEHOLDER\"" \
+          echo '#define UTS_RELEASE "6.1.0-vpnhide-ci"' \
               > include/generated/utsrelease.h
-          echo -n "$PLACEHOLDER" > include/config/kernel.release
+          echo -n "6.1.0-vpnhide-ci" > include/config/kernel.release
 
       - name: Build kernel module
         run: |
-          make -C kernel-source M=$GITHUB_WORKSPACE/kmod \
+          export KERNEL_SRC=$GITHUB_WORKSPACE/kernel-source
+          make -C $KERNEL_SRC M=$GITHUB_WORKSPACE/kmod \
               ARCH=arm64 LLVM=1 LLVM_IAS=1 \
+              CC=$CLANG_DIR/clang LD=$CLANG_DIR/ld.lld \
+              AR=$CLANG_DIR/llvm-ar NM=$CLANG_DIR/llvm-nm \
+              OBJCOPY=$CLANG_DIR/llvm-objcopy \
+              OBJDUMP=$CLANG_DIR/llvm-objdump \
+              STRIP=$CLANG_DIR/llvm-strip \
               CROSS_COMPILE=aarch64-linux-gnu- \
               modules
           ls -lh kmod/vpnhide_kmod.ko