feat(network): add debug routing controls

[Afcoo]

Summary

Add debug-only menu bar controls for Network Routing and keep routing manual when USB passthrough is requested from explicit controls in debug mode.

Changes

• Add Start/Restart and Stop Network Routing actions above Settings in the debug menu bar UI.
• Preserve the pending USB attachment's allowsAutomaticNetworkRoutingStart policy through asynchronous VM and passthrough work.
• Continue automatic routing for detected-device prompt approvals, while Settings, menu bar, and replacement actions remain manual in debug mode.
• Preserve the existing automatic behavior outside debug mode.
• Add Korean menu localizations, update repository guidance, and increment the app/helper build to 21.

Related issue

None.

Validation

• ./script/build_and_run.sh --verify
• Checks run and unverified runtime paths are documented
  • git diff --check
  • plutil -lint for the project, property lists, and entitlements
  • xmllint --noout for shared schemes
  • xcodebuild -project ThruRNDIS.xcodeproj -list
  • xcodebuild -project ThruRNDIS.xcodeproj -scheme ThruRNDIS -configuration Debug -derivedDataPath /tmp/ThruRNDIS-Review-DerivedData CODE_SIGNING_ALLOWED=NO build
• Signed Runtime validation with ./script/build_and_install.sh
• Real USB/VZNAT route validation
• Not applicable; explanation:

The app was not launched during unsigned validation. Signed helper, AccessoryAccess, real RNDIS passthrough, and host Bond/feth/bridge/route behavior remain unverified.

User-facing impact

When Debug Mode is enabled, the menu bar now exposes Network Routing Start/Restart and Stop actions immediately above Settings. USB attachment from Settings, the menu bar, or the replacement flow leaves routing stopped until an explicit Start; attachment accepted through the detected-device prompt retains automatic routing. No screenshot was captured because the app was not launched during validation.

Security and architecture

Host network mutation and the helper XPC contract are unchanged. The app only controls whether a successful USB attachment arms the existing NetworkRouteStore reconciliation; all Bond, feth, bridge, and route mutation remains in ThruRNDISPrivilegedHelper.

Checklist

• The pull request has one focused purpose.
• The title follows Conventional Commits, for example fix(usb): serialize detach handling.
• Behavior changes include appropriate build or runtime validation, with unavailable paths explained.
• User-facing behavior and operational changes are documented.
• New, moved, renamed, or deleted Swift files are reflected in Xcode groups, target membership, and build phases. No Swift files were added, moved, renamed, or deleted.
• No credentials, provisioning profiles, personal signing values, or local build artifacts are included.
• Guest VM scripts and VM Asset build tooling remain in Afcoo/ThruRNDIS_VM_Assets.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T14:43:27.681578Z	5b5081c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.