CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

.gitignore

@@ -0,0 +1,18 @@
+# harness / local
+.claude/
+*.log
+
+# kernel-module build intermediates + local build tree
+common/kmod/.gki-build/
+common/kmod/*.o
+common/kmod/.*.cmd
+common/kmod/*.mod
+common/kmod/*.mod.c
+common/kmod/*.mod.o
+common/kmod/Module.symvers
+common/kmod/modules.order
+common/kmod/.tmp_versions/
+
+# backups / device-specific
+common/kmod/*.ko.badvermagic
+common/kmod/device.config