release: document susfs feature options with real semantics

Replace the one-line SUSFS feature list with the actual option
semantics from the pinned susfs4ksu source, and clarify that
AVC_SPOOF is a runtime module toggle, not a build-time Kconfig
option.

.github/config/RELEASE_NOTES.md

@@ -48,14 +48,16 @@ A KSU addon for hiding root using kernel patches and a userspace module!
 
 Reccomended Module: [susfs4ksu-module by sidex15](https://github.com/sidex15/susfs4ksu-module)
 
-- SUS_PATH - Hide suspicious paths
-- SUS_MOUNT - Hide mount points (no CLI support)
-- SUS_KSTAT - Spoof kernel statistics
-- SPOOF_UNAME - Kernel version spoofing
-- SPOOF_CMDLINE - Boot parameter spoofing
-- OPEN_REDIRECT - File access redirection
-- SUS_MAP - Memory mapping protection
-- AVC_SPOOF - Spoof procfs avc denial logs
+- SUS_PATH - Hide suspicious paths: hides the user-defined path and all its sub-paths from various system calls. Use `add_sus_path_loop` instead of `add_sus_path` if the path is frequently modified. Caution: may cause performance loss and is vulnerable to side-channel attacks. Effective only on zygote-spawned user app processes with uid >= 10000
+- SUS_MOUNT - Hide suspicious mounts (no CLI support): assigns fake mnt_id/mnt_group_id to mounts mounted by the ksu process until /sdcard is decrypted (evades mnt_id/mnt_group_id gap detections), and hides all sus mounts from `/proc/self/[mounts|mountinfo|mountstat]` for non-su processes
+- SUS_KSTAT - Spoof kernel statistics: spoofs the kstat of user-defined files/directories. Effective only on zygote-spawned user app processes with uid >= 10000
+- SPOOF_UNAME - Kernel version spoofing: spoofs the string returned by the uname syscall to a user-defined string. Effective on all processes
+- ENABLE_LOG - Susfs kernel logging: logs susfs events to the kernel log; uncheck to completely disable all susfs log
+- HIDE_KSU_SUSFS_SYMBOLS - Hide ksu/susfs symbols: automatically hides ksu and susfs symbols from `/proc/kallsyms`. Effective on all processes
+- SPOOF_CMDLINE_OR_BOOTCONFIG - Boot parameter spoofing: spoofs the output of `/proc/bootconfig` (GKI) or `/proc/cmdline` (non-GKI) with a user-defined file. Effective on all processes
+- OPEN_REDIRECT - File access redirection: redirects a target path to be opened with another user-defined path (both paths must exist before they can be added). Does NOT bypass detections by itself; SELinux permissions for both paths are the user's responsibility. Effective only on processes with a pre-defined uid scheme
+- SUS_MAP - Memory mapping protection: hides mmapped real files from `/proc/<pid>/[maps|smaps|smaps_rollup|map_files|mem|pagemap]`. No anon-memory support; does not hide inline/PLT hooks caused by the injected library itself; may not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with uid >= 10000
+- AVC_SPOOF - Spoof procfs avc denial logs (enabled at runtime via the sidex15 module — not a build-time Kconfig option)
 
 {{SUSFS_BRANCHES}}