fix(detect): never bind USB gadget iface as proxy egress

设备把自己当 USB 网卡挂给上游主机时会出现 usb0（驱动 configfs-gadget.g1，
IP 192.168.68.1）。该链路只通向 PC，被当成出口后所有出站都 context
deadline exceeded，客户端看到 socks connect failed rep=0x01。

误选原因：score_iface_as_cellular 给 usb0 与真出口 wwan0 都打 175 分。
usb0 靠名称命中 patterns 里的 usb（+80）与非默认路由（+40）；wwan0 的
bam-dmux 驱动不在白名单里，白丢 +100。detect_cellular_iface 用 -gt 比较，
list_ifaces 按名排序让 usb0 先入选，平分下无法被顶替。

改动：
- lib.sh 新增 iface_is_usb_gadget()，按驱动名与 gadget 总线路径识别，
  并并入 is_virtual_or_skip_iface（usb0 评分 175 -> 0）
- 驱动白名单补 bam-dmux/bam_dmux/qcom-ipa/ipa_wan；名称权重 80 -> 40，
  确保驱动证据始终压过名称猜测
- 新增 detect_cellular_iface_via_mm()，把 ModemManager bearer 的
  interface: 作为第 0 步权威来源
- detect_cellular_iface / resolve_cellular 全链路拒绝 gadget 网卡，
  取不到真出口时按 REQUIRE_CELLULAR_IFACE 直接失败而不是绑错
- generate/install/upgrade/watch/detect/verify 各入口独立设闸，
  verify.sh 发现出口是 gadget 时直接 exit 4 并给出修复命令
- 默认 CELLULAR_IFACE_PATTERNS 去掉 usb/enx；upgrade.sh 与根 install.sh
  就地迁移已有 settings.conf，旧机器升级即修复
- 新增 tests/detect-gadget.sh：18 条离线断言，无需真机

scripts/install.sh

@@ -20,12 +20,19 @@ info "1/6 自动探测并绑定数据网卡"
 "$ROOT_DIR/scripts/detect.sh" || true
 
 cell=""
-if [[ -n "${CELLULAR_IFACE:-}" ]] && iface_exists "$CELLULAR_IFACE"; then
+if [[ -n "${CELLULAR_IFACE:-}" ]] && iface_is_usb_gadget "$CELLULAR_IFACE"; then
+  warn "配置的 CELLULAR_IFACE=$CELLULAR_IFACE 是 USB gadget 网卡（面向上游主机），忽略并重新探测"
+  cell=""
+elif [[ -n "${CELLULAR_IFACE:-}" ]] && iface_exists "$CELLULAR_IFACE"; then
   cell="$CELLULAR_IFACE"
   info "使用配置的数据网卡: $cell"
-elif [[ "$AUTO_DETECT" == "true" ]]; then
+fi
+if [[ -z "$cell" && "$AUTO_DETECT" == "true" ]]; then
   cell="$(detect_cellular_iface "" || true)"
 fi
+if [[ -n "$cell" ]] && iface_is_usb_gadget "$cell"; then
+  die "拒绝把 USB gadget 网卡 $cell 写成数据出口，请手动设置 CELLULAR_IFACE=wwanX"
+fi
 
 if [[ -z "$cell" ]]; then
   die "未能自动探测数据网卡。
@@ -119,9 +126,12 @@ case "$cmd" in
     # shellcheck source=/dev/null
     source "$BASE/scripts/lib.sh"
     load_config
-    if [[ -z "${CELLULAR_IFACE:-}" ]] || ! iface_exists "${CELLULAR_IFACE:-}"; then
+    if [[ -z "${CELLULAR_IFACE:-}" ]] || ! iface_exists "${CELLULAR_IFACE:-}" || iface_is_usb_gadget "${CELLULAR_IFACE:-}"; then
+      if [[ -n "${CELLULAR_IFACE:-}" ]] && iface_is_usb_gadget "${CELLULAR_IFACE:-}"; then
+        warn "CELLULAR_IFACE=$CELLULAR_IFACE 是 USB gadget 网卡，重新探测"
+      fi
       cell="$(detect_cellular_iface "" || true)"
-      if [[ -n "$cell" ]]; then
+      if [[ -n "$cell" ]] && ! iface_is_usb_gadget "$cell"; then
         src="$(detect_source_ip "$cell" || true)"
         persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
         CELLULAR_IFACE="$cell"
@@ -149,6 +159,7 @@ case "$cmd" in
     load_config
     cell="$(detect_cellular_iface "" || true)"
     [[ -n "$cell" ]] || die "未能探测数据网卡"
+    ! iface_is_usb_gadget "$cell" || die "探测到的 $cell 是 USB gadget 网卡，不能作为数据出口"
     src="$(detect_source_ip "$cell" || true)"
     persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
     info "已重新绑定 $cell src=${src:-}"