CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

action.sh

@@ -0,0 +1,38 @@
+#!/system/bin/sh
+# CellGuard — KernelSU-Next "Action" button handler.
+# Shows enforcement + diagnostics status.
+
+MODDIR=${0%/*}
+PATH=/system/bin:$PATH
+CONFIG_DIR="/data/adb/cellguard"
+
+echo "== CellGuard status =="
+
+# --- enforcement (LTE + 5G/NR only) ---
+if pgrep -f "$MODDIR/ratlock.sh" >/dev/null 2>&1; then
+  if [ "$(cat "$CONFIG_DIR/enabled" 2>/dev/null)" = 0 ]; then
+    echo "RAT lock:   running, BLOCK toggle OFF (all RAT allowed)"
+  else
+    echo "RAT lock:   RUNNING (LTE + 5G/NR only, 2G/3G blocked)"
+  fi
+else
+  echo "RAT lock:   NOT running — reboot or run: sh $MODDIR/ratlock.sh &"
+fi
+for s in 0 1; do
+  v=$(cmd phone get-allowed-network-types-for-users -s "$s" 2>/dev/null)
+  [ -n "$v" ] && echo "  SIM$s allowed: $v"
+done
+
+# --- diagnostics (kernel CP-frame capture) ---
+if [ -e /proc/cgcap/frames ]; then
+  total=$(head -1 /proc/cgcap/frames | sed -n 's/.*total=\([0-9]*\).*/\1/p')
+  echo "Diag capture: ACTIVE (cgcap) — frames seen: ${total:-0}"
+  echo "  raw diag:   /proc/cgcap/frames  (all cpif channels)"
+else
+  echo "Diag capture: OFF — cgcap.ko not loaded"
+fi
+
+echo
+echo "Decode + IMSI-catcher heuristics run off-device (Android has no Python):"
+echo "  adb shell su -c 'cat /proc/cgcap/frames' > frames.txt"
+echo "  python3 tools/cg_decode.py frames.txt"