2026.8.31

Pin xray-core to the v26.7.28 pre-release

Commit 5ca6f4b7 carries the new xmux default of maxConnections 3
(upstream 18e28390). The previous pin cb7bfeb5 predates it and
defaulted XHTTP outbounds to one HTTP/2 connection per proxied
connection, which cost about 212 KB each and caused memory kills
during heavy browsing. The new pin also carries the fix for stalled
XHTTP dials that parked their goroutine without a timeout (#6590) and
the goroutine leak in the Reality server on abnormal disconnects
(#6690). Measured on iOS: retention after a 150-connection burst fell
from +18.3 MB to +2 MB and idle recovery is complete without a forced
collection.

The new pin pulls in wlynxg/anet, whose Android build uses
go:linkname to reach net.zoneCache, so the Android builds now pass
-checklinkname=0 to the linker.