Add supervisor to keep enforcement + detection daemons alive

cgwatch.sh respawns ratlock/cgdetect within ~30s if either dies (crash,
OOM, accidental kill), so the guard self-heals instead of staying down
until the next reboot. service.sh now launches the supervisor after the
RIL-up wait rather than starting the two daemons directly.

cgwatch.sh

@@ -0,0 +1,28 @@
+#!/system/bin/sh
+# CellGuard supervisor — keeps the enforcement (ratlock) and detection
+# (cgdetect) daemons alive and respawns either one if it dies, so a crash,
+# a one-off OOM, or an accidental kill self-heals within ~30s instead of
+# leaving the guard down until the next reboot.
+#
+# Started once by service.sh at boot. Respawned daemons are launched with
+# setsid so they reparent to init (ppid=1) and survive this supervisor and
+# any adb/su session. pgrep uses short script-name patterns — this script's
+# own cmdline is "sh .../cgwatch.sh", so it never self-matches ratlock/cgdetect.
+
+MODDIR=${0%/*}
+CG=/data/adb/cellguard
+mkdir -p "$CG"
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$CG/cgwatch.log"; }
+
+log "cgwatch start (pid $$)"
+while true; do
+  if ! pgrep -f ratlock.sh >/dev/null 2>&1; then
+    setsid sh "$MODDIR/ratlock.sh" 5 </dev/null >/dev/null 2>&1 &
+    log "respawned ratlock"
+  fi
+  if ! pgrep -f cgdetect.sh >/dev/null 2>&1; then
+    setsid sh "$MODDIR/cgdetect.sh" 4 </dev/null >/dev/null 2>&1 &
+    log "respawned cgdetect"
+  fi
+  sleep 30
+done