fix(wgnest): make gomobile bind work in CI (android-release was failing)

The android-release "Build wgnest AAR" step failed with
"gomobile: missing golang.org/x/mobile dependency". Two causes:

- go.mod had drifted to `go 1.26.5` (a local `go get` bumped it); CI's setup-go
  is 1.25, so it triggered a toolchain switch that lost the x/mobile tool context.
  Pin `go 1.25.0` (x/crypto v0.54.0 needs >= 1.25.0; matches CI exactly — no
  toolchain download).
- The go1.24 `tool` directive isn't reliably honored by gomobile bind. Replace it
  with the classic tools.go blank import (`//go:build tools`), which keeps
  golang.org/x/mobile a DIRECT dependency on every Go version.

Verified: build-android.sh produces wgmobile.aar again, and `go build ./...`
(normal, no tools tag) still builds. Same go.mod feeds build-ios.sh, so the iOS
xcframework build gets the fix too.

Author: TheTrunk

clients/native/wgnest/go.mod

@@ -1,15 +1,15 @@
 module github.com/runonflux/cumulusvpn-wgnest
 
-go 1.26.5
+go 1.25.0
 
 require (
 	golang.org/x/crypto v0.54.0
+	golang.org/x/mobile v0.0.0-20260709172247-6129f5bee9d5
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 )
 
 require (
 	github.com/google/btree v1.0.1 // indirect
-	golang.org/x/mobile v0.0.0-20260709172247-6129f5bee9d5 // indirect
 	golang.org/x/mod v0.38.0 // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
@@ -19,5 +19,3 @@ require (
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 )
-
-tool golang.org/x/mobile/cmd/gobind

clients/native/wgnest/tools.go

@@ -0,0 +1,12 @@
+//go:build tools
+
+// This file exists only to keep golang.org/x/mobile in the module's dependency
+// graph as a DIRECT requirement, so `gomobile bind` (build-{android,ios}.sh)
+// works — gomobile refuses to run if x/mobile isn't a required dependency, and
+// nothing else in this module imports it. The classic "tools.go" convention
+// (works on every Go version, unlike the go1.24 `tool` directive, which gomobile
+// doesn't reliably honor). It is never compiled into any real build (the `tools`
+// build tag is never set).
+package wgnest
+
+import _ "golang.org/x/mobile/cmd/gobind"