Release 3.8.2.1: reliability, UI probe/logs, CI, signing gates.

Clear sysproxy on core death; probe+reconnect; subscription prune;
Best ignores soft UDP; Windows tray; Android protocol gate; CI workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/build-macos-arm64.sh

@@ -40,10 +40,22 @@ printf '%s\n' "$FULL" > "$OUT/VERSION"
 printf '%s\n' "${VERSION}+${BUILD}" > "$OUT/Navis.version"
 
 # Ad-hoc sign CLI/bin; packmac also signs the .app (honors NAVIS_CODESIGN_IDENTITY).
+# Set REQUIRE_CODESIGN=1 for release builds (fails without a real Developer ID identity).
+if [[ "${REQUIRE_CODESIGN:-}" == "1" ]]; then
+  if [[ -z "${NAVIS_CODESIGN_IDENTITY:-}" || "${NAVIS_CODESIGN_IDENTITY}" == "-" ]]; then
+    echo "REQUIRE_CODESIGN=1 requires NAVIS_CODESIGN_IDENTITY (Developer ID Application: …)" >&2
+    exit 1
+  fi
+fi
 if command -v codesign >/dev/null 2>&1; then
-  ID="${NAVIS_CODESIGN_IDENTITY:--}"
-  codesign -s "$ID" --force "$OUT/Navis" || codesign -s - --force "$OUT/Navis"
-  codesign -s "$ID" --force "$OUT/Navis-cli" || codesign -s - --force "$OUT/Navis-cli"
+  if [[ -n "${NAVIS_CODESIGN_IDENTITY:-}" && "${NAVIS_CODESIGN_IDENTITY}" != "-" ]]; then
+    ID="$NAVIS_CODESIGN_IDENTITY"
+    codesign -s "$ID" --force --options runtime --timestamp "$OUT/Navis"
+    codesign -s "$ID" --force --options runtime --timestamp "$OUT/Navis-cli"
+  else
+    codesign -s - --force "$OUT/Navis" || true
+    codesign -s - --force "$OUT/Navis-cli" || true
+  fi
 fi
 
 go run ./tools/packmac -bin "$OUT/Navis" -out "$OUT" -version "$VERSION" -build "$FULL" -arch arm64
@@ -65,9 +77,9 @@ h = hashlib.sha256(binp.read_bytes()).hexdigest()
 zh = hashlib.sha256(zipp.read_bytes()).hexdigest() if zipp.exists() else ""
 dh = hashlib.sha256(dmgp.read_bytes()).hexdigest() if dmgp.exists() else ""
 notes = (
-    f"Navis {ver}+{build}: меньше нагрузки в простое (лёгкий опрос UI, кэш ядер, "
-    f"список серверов не мигает); быстрее пинг; стабильнее логи и AWG-прокси; "
-    f"параллельная работа на нескольких ядрах CPU."
+    f"Navis {ver}+{build}: при падении ядра снимается системный прокси; логи и проверка туннеля в UI; "
+    f"автопереподключение / connect-on-launch; подписка чистит устаревшие ноды; «Лучший» без soft-ok UDP; "
+    f"CI и строгая подпись релиза."
 )
 paths = [
     Path('dist/update.json'),
@@ -95,6 +107,23 @@ for p in paths:
             'dmg_url',
             'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release/darwin-arm64/Navis.dmg',
         )
+    # Refresh checksums for any other darwin trees present on disk (amd64/universal).
+    base = 'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release'
+    for key in ('darwin-amd64', 'darwin-universal'):
+        if key not in plats:
+            continue
+        plat_dir = Path('dist/navis-release') / key
+        bin2 = plat_dir / 'Navis'
+        zip2 = plat_dir / 'Navis.app.zip'
+        dmg2 = plat_dir / 'Navis.dmg'
+        if bin2.exists():
+            plats[key]['sha256'] = hashlib.sha256(bin2.read_bytes()).hexdigest()
+        if zip2.exists():
+            plats[key]['zip_sha256'] = hashlib.sha256(zip2.read_bytes()).hexdigest()
+            plats[key].setdefault('zip_url', f'{base}/{key}/Navis.app.zip')
+        if dmg2.exists():
+            plats[key]['dmg_sha256'] = hashlib.sha256(dmg2.read_bytes()).hexdigest()
+            plats[key].setdefault('dmg_url', f'{base}/{key}/Navis.dmg')
     p.write_text(json.dumps(d, ensure_ascii=False, indent=2) + '\n')
     print('updated', p, '->', ver, 'bin', h[:12], 'zip', zh[:12] if zh else '-')
 PY