Theettam 2.5 — SELinux fsck_untrusted spoof + all 7 flavors

Theettam Kernel — peridot 6.1.175 (POCO F6 / Redmi Turbo 3, SM8635). All 7 root flavors, green.

New in 2.5

• 🛡️ SELinux DirtySepolicy spoof (SukiSU flavors) — selinux_hide now reports the fsck_untrusted → self:capability sys_admin edge as denied to detection apps (Duck Detector's DirtySepolicy canary). The live policy rule is untouched, so fsck/adoptable-storage still works — only the app-visible SELinux decision flips. Applies to SukiSU-Ultra + SUSFS and Premium SukiSU flavors (KSUN/ReSukiSU/APatch don't ship SukiSU's selinux_hide).
• 🎨 Theettam-branded installer (ASCII banner + Malayalam-search message), carried over from 2.4.1.

Flavors — flash the one you want in OrangeFox / recovery:

• KSUN3.3.0 — KernelSU-Next v3.3.0 (plain, no SUSFS)
• KSUN3.3.0-SUSFS2.2.0 — KernelSU-Next + SUSFS v2.2.0
• KSUN3.3.0-SUSFS2.2.0-DroidSpaces — KSUN + SUSFS + DroidSpaces
• SukiSU-Ultra-SUSFS2.2.0 — SukiSU-Ultra + SUSFS v2.2.0 + KPM (has the fsck_untrusted spoof)
• Theettam-Premium-SukiSU-SUSFS-DroidSpaces — SukiSU-Ultra + SUSFS + DroidSpaces (has the fsck_untrusted spoof)
• ReSukiSU-SUSFS2.2.0 — ReSukiSU + SUSFS v2.2.0
• APatch-KernelPatch0.13.2 — APatch (real KPM)

Companion: VoltageOS users → flash the ROM Prop Hide module for 0-Danger in Duck Detector. (Remaining Custom-ROM warning = ROM-baked libstagefright/hal_lineage, needs a ROM rebuild.)

Base: peridot 6.1.175 (ACK android14-6.1-lts + BORE + ADIOS).