fix(ci): don't dirty committed module.prop when injecting updateJson

Yesterday's Phase 2 commit left the zygisk and portshide CI artifacts
carrying a "-dirty" suffix in their module.prop version: CI appended
`updateJson=...` to the committed module.prop *before* calling
build-zip.sh, so when build-version.sh ran inside the script it saw
the dirtied working tree and `git describe --dirty` appended "-dirty".

Move the updateJson injection into build-zip.sh itself, gated on an
UPDATE_JSON_URL env var. CI sets the env var via the job step `env:`
block; committed module.prop files are no longer touched. Local dev
builds leave the var unset and ship without updateJson, matching the
previous behaviour.

kmod CI already did things in the right order (version computed
before any module.prop edits); left that step as-is.

.github/workflows/ci.yml

@@ -131,9 +131,10 @@ jobs:
           restore-keys: cargo-${{ runner.os }}-
 
       - name: Build module zip
+        env:
+          UPDATE_JSON_URL: https://raw.githubusercontent.com/okhsunrog/vpnhide/main/update-json/update-zygisk.json
         run: |
           cd zygisk
-          echo "updateJson=https://raw.githubusercontent.com/okhsunrog/vpnhide/main/update-json/update-zygisk.json" >> module/module.prop
           ./build-zip.sh
 
       - name: Upload artifact
@@ -192,9 +193,10 @@ jobs:
           fetch-depth: 0
 
       - name: Package ports module zip
+        env:
+          UPDATE_JSON_URL: https://raw.githubusercontent.com/okhsunrog/vpnhide/main/update-json/update-ports.json
         run: |
           sudo apt-get update -qq && sudo apt-get install -y -qq zip >/dev/null
-          echo "updateJson=https://raw.githubusercontent.com/okhsunrog/vpnhide/main/update-json/update-ports.json" >> portshide/module/module.prop
           cd portshide
           ./build-zip.sh
           mv vpnhide-ports.zip "$GITHUB_WORKSPACE/vpnhide-ports.zip"