refactor(android): run the stock Xray binary instead of libXray

[GreatRedem]

The core is now the same official Xray-core artifact the desktop builds use, shipped per ABI as libxray.so and run as a child process, with the VpnService tun fd handed over through XRAY_TUN_FD. libXray's gomobile AAR - and the libgojni.so it carried - is gone.

The reason the in-process design existed is that Java's ProcessBuilder closes every fd above stderr before exec, so a core spawned from Kotlin could never see the tun fd. That is a ProcessBuilder behaviour, not a kernel one: a native fork/exec inherits whatever is not marked FD_CLOEXEC, and dup() returns a copy with that flag cleared. So the spawn lives in Rust (android_core.rs, called over JNI from XrayCore.kt) and the copy survives exec under the number XRAY_TUN_FD names.

Two consequences worth knowing:

• protect() cannot reach another process's sockets, so keeping the core's uplink out of the tunnel it serves now rests entirely on addDisallowedApplication(packageName) - a uid rule, which the child inherits. That call failing now abandons the tunnel instead of being swallowed, because the alternative is a routing loop.
• The core's stdio goes to /dev/null, so a bad config surfaces as the process exiting during its startup grace period rather than as a logged Xray error.

libxray.so is an executable wearing a library name: since API 29 the only directory an app may exec from is nativeLibraryDir, and the only way into it is the APK's lib// - hence useLegacyPackaging, so the file is extracted at install rather than left compressed in the APK.

fetch-core --android now pulls Xray-android-arm64-v8a and Xray-android-amd64 and verifies each against its published .dgst; the AAR had no digest to check against at all.

Not verified on hardware: that the dup'd fd survives exec and Xray's tun inbound picks it up.

What does this change?

How was it verified?

• Tested on:

Screenshots

Checklist

• npm run check passes (typecheck + lint).
• cargo check passes, if I touched src-tauri/.
• I ran the real app (npm run desktop), not just the browser build.
• Commits follow Conventional Commits - they become
  the release notes.
• New user-facing strings are in src/lib/i18n/ and added to every locale.
• Layout still works right-to-left (Persian / Arabic), if I touched UI.
• No credentials, server addresses, or subscription URLs in code, comments, logs, or this
  description.
• No dead code or compatibility shims left behind.