Release 3.8.2.1: reliability, UI probe/logs, CI, signing gates.

Clear sysproxy on core death; probe+reconnect; subscription prune;
Best ignores soft UDP; Windows tray; Android protocol gate; CI workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/vpnapp/main_darwin.go

@@ -19,6 +19,7 @@ import (
 	"vpnclient/internal/config"
 	"vpnclient/internal/core"
 	"vpnclient/internal/logbuf"
+	"vpnclient/internal/trayhost"
 	"vpnclient/internal/update"
 )
 
@@ -56,6 +57,7 @@ func main() {
 	a.OnAfterUpdate = func() {
 		go func() {
 			time.Sleep(300 * time.Millisecond)
+			_ = a.Disconnect()
 			os.Exit(0)
 		}()
 	}
@@ -69,6 +71,16 @@ func main() {
 	go func() {
 		_ = srv.Serve(ln)
 	}()
+	a.StartBackground()
+	trayhost.Start("Navis", trayhost.Hooks{
+		Connect:    func() { _ = a.Connect() },
+		Disconnect: func() { _ = a.Disconnect() },
+		Quit: func() {
+			_ = a.Disconnect()
+			os.Exit(0)
+		},
+		IsUp: func() bool { return a.Mgr.Status().Connected },
+	})
 	go a.AutoCheckUpdate()
 
 	w, err := glaze.New(false)