FamilyVPN: official sing-box Android library build

Core repository: https://github.com/SagerNet/sing-box
Tag: v1.14.4
Commit: c005f35300ce76427dc285481ec5695f5b179cd2
Core tracked source was not modified.
Compatible official Android client reference: SagerNet/sing-box-for-android
Commit pinned by core gitlink: f87c2ebdb7e34754be751bb5e58926db2fed8f8c

Tools: official Go 1.26.10 windows-amd64; Android NDK r28 (28.0.13004108);
official SagerNet gomobile/gobind v0.1.13; Microsoft OpenJDK 17.0.20.
Official downloads and checksums: tool-downloads.json.

Build command (inside sing-box after sourcing build-env.ps1):
go run ./cmd/internal/build_libbox -target android -platform android/arm64,android/amd64

The upstream command builds main API24 and a legacy API21 variant. The main
API24 variant completed. Legacy was stopped at the parent's request because
FamilyVPN minSdk26 does not use it. No legacy AAR is claimed as built.

Windows host compatibility: NDK's .cmd clang launchers exceed cmd.exe's 8191
character limit during final linking. Private NDK hard links named
aarch64-linux-android24-clang.exe / x86_64-linux-android24-clang.exe (and C++
and API21 equivalents) point at the unmodified official clang executable.
The compiler infers its target from these names. --version verified each
requested target. This bypasses the batch wrapper without changing core
source or compiler code. prepare-ndk-aliases.ps1 recreates/verifies the aliases.

Outputs: android/app/libs/libbox.aar is the integration copy. Full AAR hash,
entry hashes, ABI sizes and CRC evidence: inspection/aar-check.json.
Native ELF reports confirm correct architectures, 16KB LOAD alignment and
only Android system shared library dependencies. Java ABI: inspection/public-api.javap.txt.
Embedded Go module versions/build tags: inspection/buildinfo-*.txt.

Licensing: libbox is distributed under the upstream GNU GPL v3 or later
notice, including its naming/association clause. See licensing/sing-box-LICENSE.txt
and licensing/GPL-3.0.txt. FamilyVPN uses its own application name. License
notices collected from all 113 Go modules embedded in the arm64 binary are
in licensing/third-party with module-license-inventory.json; Go's license
is also included. These are notices, not a substitute for corresponding
source obligations. The exact unchanged core source archive is
sing-box-v1.14.4-source.zip; go.mod/go.sum pin dependency source versions.

This build proves the AAR packaging and native ABI properties. It does not
prove phone/emulator installation, Android VPN permission, tunnel connection,
network switching or actual routed traffic. Those are separate app checks.

Build space: tools/module cache/source retained under work/android-build.
Temporary Go/gomobile scratch was moved to the explicitly authorized
C:/Users/User/AppData/Local/Temp/FamilyVPN-libbox-build after D: became low.
cleanup-manifest.json inventories only this build's disposable cache/scratch.
No current Windows VPN, device or server was accessed by this build task.
