LTS 稳定版:长连接保活修复 + HarmonyOS 桌面托盘 + OHOS 核心/HAP CI - #160

The parent repo pins core to 1638edba, which xfz347/Clash.Meta no longer has
("not our ref"), so git submodule update fails. Clone the default branch tips
instead to unblock the build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

release-branch.go1.24 of ohos_golang_go lacks the legacy -tlsmodegd flag.
Newer OHOS Go ports expose a real GOOS=ohos target that handles c-shared TLS
natively (and implies the `ohos` build tag), so build with that instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

go1.24 branch gates c-shared off for ohos and lacks -tlsmodegd. Revert to the
project's proven recipe (GOOS=linux + c-shared + -tlsmodegd) on release-branch.go1.23.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Only master, release-branch.go1.24, and go1.24_HiShell exist on the mirror;
go1.24 lacks -tlsmodegd. master is the only untried branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The public ohos_golang_go branches (go1.24/master) don't carry the -tlsmodegd
flag. Vendor moodyhunter/libHv2rayCore's 0001-support-tls-mode-gd.patch (adds the
flag + arm64 general-dynamic TLS via TLSDESC + musl c-shared runtime fixes) and
apply it to the go1.24 source before make.bash. Cache key now includes the patch
hash; link with -fuse-ld=lld per the reference recipe.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The OHOS go1.24 fork has its own edits in flags.go/base.flag.go and rejects the
patch. The patch targets upstream go1.24, so clone golang/go release-branch.go1.24
as the base (also drops the flaky gitcode dep); add --fuzz=3 fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Patch was cut against a specific go1.24.x; current release-branch HEAD drifted in
flags.go/base.flag.go. Full single-branch clone + git apply --3way merges past it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

moodyhunter/go-tls-mode-gd is go1.26.2 with tls-mode-gd already applied, so clone
and make.bash it directly instead of patching stock go and fighting point-release
drift. Removes the vendored patch and the apply step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

xfz347/Clash.Meta default branch (main) has no go.mod; the OHOS-adapted code +
go.mod live on the `ohos` branch (same for likuai2010/gvisor-ohos). Pin both
clones to ohos and sanity-check go.mod presence.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The ohos-branch core needs deps not in flclash's pinned go.sum (go-ordered-map,
go-chi, sagernet/cors); -mod=mod lets go download + record them.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flclash's pinned go.mod pulls newer metacubex/quic-go+sing-quic than the ohos core
(API drift: component/tls vs metacubex/tls). Reinit a minimal go.mod + go mod tidy
so ./core's go.mod picks the matching (older) versions. GOTOOLCHAIN=local avoids
toolchain auto-download over the flaky network.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- docs/lts-connection-lifecycle-audit.md: call-graph audit proving public LTS
  has no automatic ClearConnections caller (destructive paths are manual or
  deliberate profile-switch/recovery only)
- docs/lts-stable-build.md: why this build replaces store V2
- version identity 1.7.4-lts-stable.1 (1007048), bundle unchanged
  (org.xbgroup.clashboxLTS, coexists with store V2)

No application-logic change.

- INVESTIGATION-2026-08-11-synchronized-fin.md: full root-cause record
  (store V2 ~180.5s UI-timer ClearConnections; mechanism, discriminators,
  exonerations, instrumented-build notes)
- latest_analysis.md: UI-execution-gated timer evidence (CPU-measured A/B/A)
- VERIFICATION-PROTOCOL.md: instrumented-build + V2 bisection protocol
- UPSTREAM-ISSUE-DRAFT.md: issue draft for xiaobaigroup/ClashBox
- LTS-BUILD-VALIDATION.md: install guide + on-device validation results
  (17min + 67min runs, zero automatic wipes, manual clear works)

Machine lock freezes/reclaims background app processes without a
continuous task, which kills the ClashBox UI process hosting the proxy
core and control plane (Codex and other proxied apps lose connectivity).

- Add ProxyKeepAliveService: auto-request TASK_KEEPING continuous task
  on proxy start (PC/2in1/tablet), release on proxy stop; idempotent,
  mutually exclusive with user-enabled keep-alive toggles; re-request
  with bounded retry when the system cancels the task.
- ClashViewModel: start keep-alive in StartVpn/ReStartVpn, stop in
  StopVpn, covering UI, widget-card and core-recovery paths.
- EntryAbility: subscribe to screen off/lock/on/unlock common events to
  reassert the continuous task around lock transitions; the existing 1s
  recovery loop then restarts the core if the VPN extension was killed.