Add AmneziaWG mode (wireproxy-awg userspace SOCKS)

Third mode alongside proxy and VLESS+Reality. Bundles wireproxy-awg built
from a pinned, audited source commit (fork of wireproxy over the official
amneziawg-go), exposing a local SOCKS5 tunnel with no TUN/driver/admin.
User picks their AmneziaWG .conf; the app appends a [Socks5] section and
routes Claude through it with the same fail-closed firewall.

build-wireproxy.ps1 reproducibly builds the binary (portable Go + pinned
commit); it is embedded as a resource and not stored in git.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build-native.ps1

@@ -34,6 +34,14 @@ if (-not (Test-Path $xrayZip)) {
   Write-Host "  Xray SHA256 ok." -ForegroundColor DarkGray
 }
 
+# wireproxy-awg (AmneziaWG userspace SOCKS). Built from pinned source; not stored in git.
+$awgExe = Join-Path $root 'wireproxy-awg.exe'
+if (-not (Test-Path $awgExe)) {
+  Write-Host "Building wireproxy-awg.exe (needs git; downloads a portable Go toolchain)..." -ForegroundColor Cyan
+  & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $root 'build-wireproxy.ps1')
+  if (-not (Test-Path $awgExe)) { throw "wireproxy-awg.exe build failed." }
+}
+
 $out = Join-Path $dist 'ClaudeProxy.exe'
 $refs = @('System.dll', 'System.Core.dll', 'System.Windows.Forms.dll', 'System.Drawing.dll',
   'System.IO.Compression.dll', 'System.IO.Compression.FileSystem.dll', 'Microsoft.CSharp.dll')
@@ -42,7 +50,8 @@ $args = @(
   '/nologo', '/target:winexe', '/platform:x64', "/out:$out",
   "/win32icon:$(Join-Path $root 'icon.ico')",
   "/win32manifest:$(Join-Path $root 'native\app.manifest')",
-  "/resource:$(Join-Path $root 'xray.zip'),ClaudeProxy.xray.zip"
+  "/resource:$(Join-Path $root 'xray.zip'),ClaudeProxy.xray.zip",
+  "/resource:$(Join-Path $root 'wireproxy-awg.exe'),ClaudeProxy.awg.exe"
 )
 foreach ($r in $refs) { $args += "/reference:$r" }
 $args += (Join-Path $root 'native\Core.cs')