feat(build): randomized build-time class-name obfuscation + pin Qt 6.10.2

Rename every shit.zen.* / asm.patchify.* class to a fresh random 16-char name in one random 16-char package on each build, via an ASM ClassRemapper pass (build.gradle ext.obfuscateJar, run after ForgeGradle reobfJar). Class names only; methods/fields preserved. Manifest Premain/Agent-Class, the DllBootstrap Class.forName string, and the native bridge name (generated_names.h OZ_BRIDGE_FQCN) are wired to the generated names. Residual original-name strings (loggers, log text, the asm.patchify.* property keys) scrubbed. Emits build/rename-mapping.txt.

Pin Qt to 6.10.2 (vcpkg builtin-baseline + CI tag 2026.04.27): MSVC 14.44 crashes building Qt 6.11.0. Build Qt single-threaded locally (VCPKG_MAX_CONCURRENCY=1, loader --parallel 1, gated off GitHub Actions) to dodge parallel-compilation compiler crashes on that toolset.

CI uploads rename-mapping.txt as an artifact and attaches it to the Release; the Release body warns that prebuilt artifacts share one fixed (blacklist-able) mapping and users should self-compile. README documents the obfuscation + the self-compile warning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

native/dll/src/class_loader.cpp

@@ -1,4 +1,5 @@
 #include "openzen.h"
+#include "generated_names.h"  // OZ_BRIDGE_FQCN — generated by build.gradle ext.obfuscateJar
 
 #include <cstring>
 
@@ -114,17 +115,24 @@ jclass load_dll_bootstrap(JNIEnv* env, jobject game_loader,
     if (check_and_clear(env, "new URLClassLoader")) return nullptr;
     log::info("URLClassLoader constructed with parent=gameLoader");
 
-    // urlcl.loadClass("shit.zen.dll.GameLoaderBridge")
+    // urlcl.loadClass(OZ_BRIDGE_FQCN)  (the build-time-obfuscated GameLoaderBridge)
     //
     // We deliberately load GameLoaderBridge - not DllBootstrap - because the
     // bridge's job is to re-define every class in zen.jar onto the game
     // class loader so retransformed Minecraft classes can resolve our patch
     // handlers (defining-loader equality). DllBootstrap is then loaded by
     // the game loader from the bridge.
+    //
+    // The build renames every OpenZen class to an opaque generated name (see
+    // build.gradle ext.obfuscateJar). It also emits generated_names.h with the
+    // bridge's new FQCN as OZ_BRIDGE_FQCN, so this stays in lockstep with the
+    // embedded jar without any hard-coded class name. The bridge's
+    // load(String, ClassLoader) method name is preserved by the rename, so the
+    // GetStaticMethodID(bridge_cls, "load", ...) lookup in main.cpp still works.
     jclass classLoaderCls = env->FindClass("java/lang/ClassLoader");
     jmethodID loadClass = env->GetMethodID(classLoaderCls, "loadClass",
         "(Ljava/lang/String;)Ljava/lang/Class;");
-    jstring name = env->NewStringUTF("shit.zen.dll.GameLoaderBridge");
+    jstring name = env->NewStringUTF(OZ_BRIDGE_FQCN);
     jobject loaded = env->CallObjectMethod(urlcl, loadClass, name);
     if (check_and_clear(env, "URLClassLoader.loadClass GameLoaderBridge")) return nullptr;
     if (!loaded) {

native/vcpkg.json

@@ -10,5 +10,4 @@
       "features": [ "widgets" ]
     }
   ],
-  "builtin-baseline": "d015e31e90838a4c9dfa3eed45979bc70d9357fc"
-}
+  "builtin-baseline": "56bb2411609227288b70117ead2c47585ba07713混淆器