R-TrustTunnel 0.4.0 — AmneziaWG 3 preview

The client now connects to AmneziaWG 3 servers in addition to TrustTunnel
and Hysteria 2. An awg-quick configuration is imported as a profile; the
transport implements the 3.1 obfuscation set (junk packets, S1–S4 padding,
H1–H4 header ranges, I1–I5 signature packets, header protection, content
padding, random trailers, cookie suppression and timer ranges) over the
WireGuard handshake, with TCP, UDP and DNS carried through the tunnel. See
AmneziaWG for the supported options and known limits.

Also new since v0.3.2-ui.2:

• Hysteria 2: port hopping, Brutal bandwidth mode, BBR/Reno selection, QUIC
  windows and timeouts, Gecko obfuscation, leaf-certificate pinSHA256
  checking and embedded mutual-TLS client credentials.
• tt:// and hy2:// profile links open the client on macOS, Windows and Flatpak.
• Refreshed desktop UI around the Flow palette and a refreshed Android home screen;
  protection state is shown per connection mode.
• Android binds the tunnel only to a foreground network.
• Windows: a closed Wintun adapter that stays listed no longer blocks the next
  connection ("Wintun adapter removal is still pending"); the service refreshes
  the adapter list through WMI. Sleep/wake always-on checks were added.
• IPv6 is refused locally when the endpoint has no IPv6 egress.

Packages:

• macOS arm64: UI Choices DMG (Native / WebView / Both), plus the Native system PKG. Ad-hoc sealed; no Developer ID/notarization.
• Windows x64: R-TrustTunnel-Windows-x64-Setup.exe, the first refreshed public installer since 0.3.2. Not Authenticode-signed.
• Linux x86_64 Wayland: three signed Flatpak variants and the signed host service package rtrust-host-0.4.0-36. The host package is now a .pkg.tar.gz built on the Fedora CI node.
• Android arm64/x86_64: signed APK, versionCode 40001, versionName 0.4.0-preview.1. Retains the existing signing certificate and upgrades over 30209.

Validation: Jenkins native #93, Linux #36 and Android #66 completed
SUCCESS on the release commit, including Gitleaks/Trivy, unit tests, the
AmneziaWG interoperability suite against amneziawg-go 3.1, the Linux
full-tunnel E2E with TrustTunnel and AmneziaWG profiles, and the Android
emulator acceptance for all three transports with reinstall/upgrade.
The Windows full tunnel was exercised with TrustTunnel and AmneziaWG profiles
in authorized runs on a physical host before the release commit: TrustTunnel
passed, AmneziaWG passed three of four runs; the fourth failed at the recovery
step after the GUI was killed and is not explained yet.

Not validated in this release:

• The macOS full-tunnel E2E was not run with an AmneziaWG profile, and the
  macOS packages were not installed on a machine in this wave.
• Physical Android phones were not used; the Android acceptance has one known
  intermittent failure (a 5 s TCP read timeout through TrustTunnel) that passes on rerun.
• An AmneziaWG peer must reply from the configured endpoint address; replies
  from another address of a multi-homed server are dropped.

After publication the Windows installer passed the authorized signed-update
maintenance run on a physical host (sequence 6 → 7 with an injected failed health
check, rollback to 6 and a successful retry), and sequence 7 was promoted to
latest.json for Windows; see secure updates. The
macOS update manifest of sequence 7 is published but not promoted. The authorized
Windows full-tunnel run was then repeated on that host with the service of build
#93: TrustTunnel and AmneziaWG each passed once, including outage, GUI crash,
service kill, always-on and network-loss steps. release-evidence.json in the
release predates both runs.

Verify downloads with SHA256SUMS and its detached signature; the OpenPGP public
fingerprint is CB9C4FB4B9CFAF255BE008C9F0E6162B056843CC.