CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

post-fs-data.sh

@@ -0,0 +1,23 @@
+#!/system/bin/sh
+# CellGuard — early-boot config load
+# Runs in post-fs-data context, before zygote.
+
+MODDIR=${0%/*}
+CONFIG_DIR="/data/adb/cellguard"
+CONFIG_FILE="$CONFIG_DIR/config.sh"
+
+mkdir -p "$CONFIG_DIR"
+
+if [ ! -f "$CONFIG_FILE" ]; then
+  cat > "$CONFIG_FILE" << 'DEFAULTS'
+# CellGuard configuration — persisted across reboots.
+# Edited by WebUI or /system/bin/cellguard.
+
+ENABLED=1
+BLOCK_2G=1
+BLOCK_3G=1
+BLOCK_NULL_CIPHER=1
+POLL_MS=1500
+CARRIER=none
+DEFAULTS
+fi