Release 3.8.2.1: reliability, UI probe/logs, CI, signing gates.

Clear sysproxy on core death; probe+reconnect; subscription prune;
Best ignores soft UDP; Windows tray; Android protocol gate; CI workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/update/update_darwin.go

@@ -61,16 +61,15 @@ func applyAppZip(p preparedUpdate) (string, error) {
 	scriptPath := filepath.Join(parent, "navis-update-app.sh")
 	pid := os.Getpid()
 	identity := strings.TrimSpace(os.Getenv("NAVIS_CODESIGN_IDENTITY"))
-	if identity == "" {
-		identity = "-"
-	}
+	// Never re-sign with ad-hoc "-" after replacing a shipped .app — that strips
+	// Developer ID / notarization. Only re-sign when a real identity is set.
+	doSign := identity != "" && identity != "-"
 
 	script := "#!/bin/bash\n" +
 		"set -e\n" +
 		"APP=" + shellQuote(p.AppRoot) + "\n" +
 		"ZIP=" + shellQuote(p.TmpPath) + "\n" +
 		"PID=" + strconv.Itoa(pid) + "\n" +
-		"ID=" + shellQuote(identity) + "\n" +
 		"PARENT=$(dirname \"$APP\")\n" +
 		"while kill -0 \"$PID\" 2>/dev/null; do sleep 0.4; done\n" +
 		"sleep 0.5\n" +
@@ -80,11 +79,15 @@ func applyAppZip(p preparedUpdate) (string, error) {
 		"if [ -z \"$NEW\" ] || [ ! -d \"$NEW\" ]; then echo 'Navis.app missing in zip' >&2; exit 1; fi\n" +
 		"rm -rf \"$APP.bak\"\n" +
 		"mv \"$APP\" \"$APP.bak\"\n" +
-		"mv \"$NEW\" \"$APP\"\n" +
-		"if command -v codesign >/dev/null 2>&1; then\n" +
-		"  codesign -s \"$ID\" --force --deep --options runtime \"$APP\" 2>/dev/null || codesign -s \"$ID\" --force --deep \"$APP\" || true\n" +
-		"  xattr -cr \"$APP\" 2>/dev/null || true\n" +
-		"fi\n" +
+		"mv \"$NEW\" \"$APP\"\n"
+	if doSign {
+		script += "ID=" + shellQuote(identity) + "\n" +
+			"if command -v codesign >/dev/null 2>&1; then\n" +
+			"  codesign -s \"$ID\" --force --deep --options runtime --timestamp \"$APP\"\n" +
+			"  codesign --verify --deep --strict \"$APP\"\n" +
+			"fi\n"
+	}
+	script += "xattr -cr \"$APP\" 2>/dev/null || true\n" +
 		"rm -rf \"$APP.bak\" \"$TMP\" \"$ZIP\" " + shellQuote(scriptPath) + "\n" +
 		"open \"$APP\"\n"