Release 3.8.2.1: reliability, UI probe/logs, CI, signing gates.

Clear sysproxy on core death; probe+reconnect; subscription prune;
Best ignores soft UDP; Windows tray; Android protocol gate; CI workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/trayhost/tray.go

@@ -0,0 +1,14 @@
+package trayhost
+
+// Hooks lets the tray menu drive the VPN app without importing apphost (avoids cycles).
+type Hooks struct {
+	Connect    func()
+	Disconnect func()
+	Quit       func()
+	IsUp       func() bool
+}
+
+// Start runs a platform tray if available. Returns false when unsupported.
+func Start(appName string, h Hooks) bool {
+	return start(appName, h)
+}