CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

sepolicy/cellguard.rule

@@ -0,0 +1,17 @@
+# CellGuard SELinux rules.
+# KernelSU-Next usually flips SELinux to permissive, but these let the
+# module coexist with enforcing mode too.
+
+# Shannon / modem AT channels
+allow su umts_device chr_file { open read write ioctl getattr }
+allow su radio_device chr_file { open read write ioctl getattr }
+
+# Our own /dev/cellguard char device
+allow su device chr_file { open read write ioctl getattr }
+
+# Insmod / rmmod
+allow su kernel system { module_load module_request }
+allow su self capability sys_module
+
+# /proc/cellguard/*
+allow su proc file { open read getattr }