Release 3.8.2.1: reliability, UI probe/logs, CI, signing gates.

Clear sysproxy on core death; probe+reconnect; subscription prune;
Best ignores soft UDP; Windows tray; Android protocol gate; CI workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/vpnapp/main_darwin.go

@@ -19,6 +19,7 @@ import (
 	"vpnclient/internal/config"
 	"vpnclient/internal/core"
 	"vpnclient/internal/logbuf"
+	"vpnclient/internal/trayhost"
 	"vpnclient/internal/update"
 )
 
@@ -56,6 +57,7 @@ func main() {
 	a.OnAfterUpdate = func() {
 		go func() {
 			time.Sleep(300 * time.Millisecond)
+			_ = a.Disconnect()
 			os.Exit(0)
 		}()
 	}
@@ -69,6 +71,16 @@ func main() {
 	go func() {
 		_ = srv.Serve(ln)
 	}()
+	a.StartBackground()
+	trayhost.Start("Navis", trayhost.Hooks{
+		Connect:    func() { _ = a.Connect() },
+		Disconnect: func() { _ = a.Disconnect() },
+		Quit: func() {
+			_ = a.Disconnect()
+			os.Exit(0)
+		},
+		IsUp: func() bool { return a.Mgr.Status().Connected },
+	})
 	go a.AutoCheckUpdate()
 
 	w, err := glaze.New(false)

cmd/vpnapp/main_windows.go

@@ -19,6 +19,7 @@ import (
 	"vpnclient/internal/config"
 	"vpnclient/internal/core"
 	"vpnclient/internal/logbuf"
+	"vpnclient/internal/trayhost"
 	"vpnclient/internal/update"
 )
 
@@ -58,6 +59,7 @@ func main() {
 		// Hard-exit so Windows unlocks Navis.exe; do not wait on webview.Terminate.
 		go func() {
 			time.Sleep(300 * time.Millisecond)
+			_ = a.Disconnect()
 			os.Exit(0)
 		}()
 	}
@@ -105,6 +107,20 @@ func main() {
 	mustBind(w, "applyUpdate", a.ApplyUpdate)
 	mustBind(w, "saveHy2", a.SaveHy2)
 	mustBind(w, "importSubscription", a.ImportSubscription)
+	mustBind(w, "getLogs", a.GetLogs)
+	mustBind(w, "probeTunnel", a.ProbeTunnel)
+	mustBind(w, "savePrefs", a.SavePrefs)
+
+	a.StartBackground()
+	trayhost.Start("Navis", trayhost.Hooks{
+		Connect:    func() { _ = a.Connect() },
+		Disconnect: func() { _ = a.Disconnect() },
+		Quit: func() {
+			_ = a.Disconnect()
+			os.Exit(0)
+		},
+		IsUp: func() bool { return a.Mgr.Status().Connected },
+	})
 
 	go a.AutoCheckUpdate()