[stealth 5/6] direct-connection denylist + no-VPN local proxy

[reflog]

Part of epic getlantern/engineering#3569 — stacked PR 5/6, targets stealth/pr4-garble.

Carved from the cleaned squash integration of the Stealth Lantern epic; the 6-PR stack reconstructs the full change exactly. All stealth behavior is build-time gated — normal builds are unchanged.

Supersedes old issues: #3568, #3573

• android/app/cpp/ndk-stl-config.cmake
• android/app/proguard-stealth-novpn.pro
• android/app/src/main/kotlin/org/getlantern/lantern/MainActivity.kt
• android/app/src/main/kotlin/org/getlantern/lantern/handler/EventHandler.kt
• android/app/src/main/kotlin/org/getlantern/lantern/handler/MethodHandler.kt
• android/app/src/main/kotlin/org/getlantern/lantern/service/NoVpnLanternService.kt
• android/app/src/main/kotlin/org/getlantern/lantern/stealth/DirectConnectionAppExclusionStore.kt
• android/app/src/main/kotlin/org/getlantern/lantern/stealth/DirectConnectionAppExclusions.kt
• android/app/src/main/kotlin/org/getlantern/lantern/utils/FlutterEventListener.kt
• android/app/src/stealthNovpn/kotlin/foundation/bridge/HomeActivity.kt
• android/app/src/stealthNovpn/kotlin/foundation/bridge/SyncService.kt
• android/app/src/stealthVpn/kotlin/foundation/bridge/HomeActivity.kt
• android/app/src/stealthVpn/kotlin/foundation/bridge/NetworkService.kt
• assets/stealth/default_exclusions.json
• docs/stealth-direct-connection-apps.md
• docs/stealth-novpn-proxy.md
• lantern-core/mobile/mobile.go
• lantern-core/utils/common.go
• lib/core/common/stealth_no_vpn_proxy.dart
• lib/features/home/no_vpn_proxy_panel.dart
• lib/features/setting/vpn_setting.dart
• lib/features/split_tunneling/apps_split_tunneling.dart
• lib/features/split_tunneling/provider/apps_notifier.dart
• lib/features/split_tunneling/provider/apps_notifier.g.dart
• lib/features/split_tunneling/split_tunneling.dart
• lib/features/vpn/provider/vpn_notifier.dart
• lib/lantern/lantern_core_service.dart
• lib/lantern/lantern_ffi_service.dart
• lib/lantern/lantern_platform_service.dart
• lib/main_stealth.dart
• test/features/split_tunneling/default_exclusions_asset_test.dart

⚠️ Blocked on radiance: the no-VPN SOCKS surface lives on radiance branch stealth/novpn-radiance-socks-surface (2 commits atop main's ce4b085), not yet published. Publish + bump the go.mod pin before novpn CI can build. Stays draft until then.

🤖 Generated with Claude Code

[reflog]

Folded into the consolidated [stealth 3/4] stealth runtime PR #8861 — the no-VPN/denylist code co-edits the same app-shell files as the feature/logging work, so it ships in the runtime PR. See #8861.