ci: export ANDROID_NDK_ROOT for Gobley plugin

Real cause of the lsposed/lint NPE on CI: Gobley's
RustAndroidTarget.ndkToolchainDir resolves the NDK by checking, in
order, the explicit `ndkRoot` parameter, `<sdkRoot>/ndk/<latestVersion>`,
then `$ANDROID_NDK_ROOT`. The CI image installs the NDK as a separate
tree at /opt/android-ndk and exports `ANDROID_NDK_HOME`, not
`ANDROID_NDK_ROOT` — so all three lookups return null and Gobley's `!!`
produces a bare `NullPointerException` during `:app` configuration.

Locally my shell exports `ANDROID_NDK_ROOT` (Android Studio convention),
which is why the issue only surfaces in CI.

Bake `ANDROID_NDK_ROOT` into the CI Dockerfile and export it inline in
the lint / lsposed gradle steps so this PR's CI passes before the image
rebuilds. Revert the prior `rustup target add x86_64-unknown-linux-gnu`
and `--stacktrace` debug additions — that was a wrong-hypothesis
workaround (the host target is already installed by `rustup-init`).

.github/docker/ci/Dockerfile

@@ -50,7 +50,7 @@ ENV RUSTUP_HOME=/usr/local/rustup \
 
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
         sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path && \
-    rustup target add aarch64-linux-android x86_64-unknown-linux-gnu && \
+    rustup target add aarch64-linux-android && \
     rustup component add rustfmt clippy && \
     cargo install cargo-ndk --locked && \
     chmod -R a+w /usr/local/rustup /usr/local/cargo
@@ -58,6 +58,9 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
 # ── Android NDK (for zygisk) ─────────────────────────────────────────
 ENV ANDROID_NDK_VERSION=r28b
 ENV ANDROID_NDK_HOME=/opt/android-ndk
+# Gobley's cargo plugin reads ANDROID_NDK_ROOT (not _HOME) to find the NDK
+# when looking up the toolchain library directory for Android Rust targets.
+ENV ANDROID_NDK_ROOT=/opt/android-ndk
 
 RUN curl -fsSL -o /tmp/ndk.zip \
         "https://dl.google.com/android/repository/android-ndk-${ANDROID_NDK_VERSION}-linux.zip" && \

.github/workflows/ci.yml

@@ -74,15 +74,17 @@ jobs:
       # Kotlin
       - name: ktlint
         run: ktlint "lsposed/**/*.kt"
-      # Gobley's cargo plugin enumerates Kotlin targets at gradle configure
-      # time and queries rustup for each, including the JVM host target.
-      # Without this target installed gradle dies with a NullPointerException.
-      - name: Add Linux x64 Rust target
-        run: rustup target add x86_64-unknown-linux-gnu
+      # Gobley's cargo plugin reads ANDROID_NDK_ROOT (not _HOME) to find the
+      # NDK at gradle configure time. The CI image only sets _HOME; export
+      # _ROOT here until the next image rebuild bakes it in.
       - name: Android lint
-        run: cd lsposed && ./gradlew --no-daemon --stacktrace :app:lint
+        run: |
+          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
+          cd lsposed && ./gradlew --no-daemon :app:lint
       - name: Kotlin unit tests
-        run: cd lsposed && ./gradlew --no-daemon :app:testDebugUnitTest
+        run: |
+          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
+          cd lsposed && ./gradlew --no-daemon :app:testDebugUnitTest
 
   kmod:
     runs-on: ubuntu-latest
@@ -206,15 +208,13 @@ jobs:
           storeFile=$KEYSTORE_PATH
           EOF
 
-      # Gobley's cargo plugin enumerates Kotlin targets at gradle configure
-      # time and queries rustup for each, including the JVM host target.
-      # Without this target installed gradle dies with a NullPointerException.
-      - name: Add Linux x64 Rust target
-        run: rustup target add x86_64-unknown-linux-gnu
-
+      # Gobley's cargo plugin reads ANDROID_NDK_ROOT (not _HOME) to find the
+      # NDK at gradle configure time. The CI image only sets _HOME; export
+      # _ROOT here until the next image rebuild bakes it in.
       - name: Build APK
         run: |
-          cd "$GITHUB_WORKSPACE/lsposed" && ./gradlew --no-daemon --stacktrace assembleRelease
+          export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
+          cd "$GITHUB_WORKSPACE/lsposed" && ./gradlew --no-daemon assembleRelease
           cp app/build/outputs/apk/release/app-release.apk "$GITHUB_WORKSPACE/vpnhide.apk"
 
       - name: Upload artifact