Add AmneziaWG mode (wireproxy-awg userspace SOCKS)

Third mode alongside proxy and VLESS+Reality. Bundles wireproxy-awg built
from a pinned, audited source commit (fork of wireproxy over the official
amneziawg-go), exposing a local SOCKS5 tunnel with no TUN/driver/admin.
User picks their AmneziaWG .conf; the app appends a [Socks5] section and
routes Claude through it with the same fail-closed firewall.

build-wireproxy.ps1 reproducibly builds the binary (portable Go + pinned
commit); it is embedded as a resource and not stored in git.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

NOTICE.md

@@ -13,3 +13,17 @@ This project bundles an **unmodified** binary of [Xray-core](https://github.com/
 Bundling and invoking Xray-core as an independent executable ("mere aggregation") does not place
 this project's own code (MIT-licensed, see `LICENSE`) under the MPL. Redistribution of the Xray
 binary is permitted by MPL-2.0 provided its license text is included, which it is.
+
+## wireproxy-awg (AmneziaWG mode)
+
+The AmneziaWG mode bundles **wireproxy-awg**, built from source and run as a separate process. It
+is a thin fork of `wireproxy` that uses the official AmneziaWG userspace implementation.
+
+- Built from a pinned, audited commit — see `build-wireproxy.ps1` (repo + commit hash).
+- `wireproxy` / `wireproxy-awg`: **ISC** license (© Tsz Fung Wong).
+- `github.com/amnezia-vpn/amneziawg-go` and `golang.zx2c4.com/wireguard`: **MIT** license.
+- All run as independent executables ("mere aggregation"); this project's code stays MIT.
+
+Reproducible build: `build-wireproxy.ps1` fetches a portable Go toolchain, checks out the pinned
+commit, and compiles a static `wireproxy-awg.exe`. It is embedded as a resource by
+`build-native.ps1` and is **not** stored in git.