CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

common/kmod/cellguard_ioctl.h

@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * cellguard userspace ioctl header.
+ * Shared with /system/bin/cellguard helper and any app that wants
+ * to drive the kernel-enforced cellular policy directly.
+ */
+#ifndef _CELLGUARD_IOCTL_H
+#define _CELLGUARD_IOCTL_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define CG_MAGIC            'C'
+#define CG_IOC_ENABLE       _IO(CG_MAGIC,  1)
+#define CG_IOC_DISABLE      _IO(CG_MAGIC,  2)
+#define CG_IOC_RELEASE      _IO(CG_MAGIC,  3)
+#define CG_IOC_GET_STATUS   _IOR(CG_MAGIC, 4, struct cg_status)
+#define CG_IOC_SCAN         _IOR(CG_MAGIC, 5, struct cg_scan)
+#define CG_IOC_SET_POLICY   _IOW(CG_MAGIC, 6, struct cg_policy)
+
+#define CG_SCAN_BUF_SIZE    16000
+
+struct cg_status {
+        __s32    enabled;
+        __s32    modem_ok;
+        char     modem_path[64];
+        char     rat[16];
+        __s32    rat_code;
+        __s32    cipher_known;
+        __s32    cipher_null;
+        char     operator_name[32];
+        char     mcc_mnc[16];
+        __s32    rsrp;
+        __s32    tx_pwr;
+        __u64    downgrades_blocked;
+        __u64    relocks;
+        __u64    polls;
+};
+
+struct cg_scan {
+        char     data[CG_SCAN_BUF_SIZE];
+        __u32    data_len;
+        __s32    status;
+};
+
+struct cg_policy {
+        __s32    block_2g;
+        __s32    block_3g;
+        __s32    block_null_cipher;
+        __s32    poll_interval_ms;
+};
+
+#endif /* _CELLGUARD_IOCTL_H */