Monitor GrapheneOS Zygote contract drift

[pixincreate]

Summary

• extract a normalized GrapheneOS Zygote compatibility contract from branch 17
• compare JNI descriptors, extra argument semantics, replay FD handling, and forkless exec-spawn behavior against an offline baseline
• run weekly or manually and maintain one bot-owned issue when semantic drift appears

Safety

• resolve branch 17 once and fetch every source from the same commit
• cap every upstream response at 2 MiB
• pin GitHub Actions to full commit SHAs and serialize monitor runs
• restrict issue writes to pixincreate/Magisk; forks remain read-only
• keep current JSON in workflow artifacts rather than issue bodies

Validation

• python3 -m unittest tests.test_grapheneos_zygote_contract (12 tests)
• python3 -m py_compile scripts/grapheneos_zygote_contract.py tests/test_grapheneos_zygote_contract.py
• live GrapheneOS branch extraction matches baseline a19bec7b...
• workflow YAML parses successfully
• five-lane review passed after correctness and security hardening

The repository scripts/env.py wrapper still has its pre-existing line 95 syntax error, so local checks used direct Python fallbacks.