v1.1.2

hkuvpn v1.1.2 - the native Windows port, fixed after field testing

The Windows port was exercised on a real machine (Windows 11 build 26300,
PowerShell 5.1). That found four bugs that no amount of static checking
would have caught. All are fixed here.

Fixed

• IPv4 mask arithmetic (Get-PrefixMaskDotted, Get-NetPrefixBase,
  Test-IpInPrefix) - PowerShell parses 0xFFFFFFFF as [int]-1, and
  casting a negative value to [uint32] throws. The first two threw for
  every prefix below /32, so the first external destination reaching the
  auto-route learner raised inside the tunnel worker and killed the
  session. Test-IpInPrefix swallowed the same exception and always
  answered false, so the NRPT rule for campus-only DNS was never
  installed. All three now use 64-bit arithmetic.
• Tools directory - get-tools.ps1 created <repo>\tools while
  hkuvpn.ps1 looked in <repo>\windows\tools, so gost was installed
  where the launcher never checked. Both agree now, and the launcher also
  accepts the old location.
• OpenConnect installer - the URL pointed at the moving GitLab CI
  master artifacts, which expire after a week (it 404s now). The script
  now downloads the official v9.21 tag build, whose artifacts never
  expire, and verifies it against a pinned SHA-256 - the same version the
  Docker image builds.
• Pre-flight session check - Get-Process -Id 0 returns the Windows
  System Idle process, and a missing pid file reads as 0, so the pre-flight
  always claimed a session was running and skipped the port check.

Also

• The Windows scripts are pure ASCII now: PowerShell 5.1 and cscript.exe
  read BOM-less files as ANSI and would mangle non-ASCII characters.
• .gitattributes normalises line endings (CRLF for the scripts Windows
  executes, LF for everything else).
• windows/tools/ is git-ignored (downloaded binaries).
• A field validation checklist
  (English / 简体中文) walks through every step with the expected output.

Verified on real hardware

Tool installation with pinned hashes, the certificate pin (byte-identical
to the openssl value), the gost proxy with both listeners, the auto-route
learner against real connection logs, the vpnc script (including its
refusal of a /0 route), the NRPT rule, and route add/delete.