fix(ksu): move selinux_hide 6.6+ fix AFTER root setup so file exists

- Kernel Fixes runs before drivers/kernelsu is checked out, so find
  never located selinux_hide.c (hence 6.6 build still failed Exit 2
  at 477/794). Move sed != NULL to build.yml right after
  Setup Selected Root Implementation (ALL branches, KVER>=6.6) where
  kernel/common/drivers/kernelsu/feature/selinux_hide.c now exists.

.github/actions/kernel-fixes/action.yml

@@ -86,34 +86,6 @@ runs:
         sed -i 's/\s*vm_flags_clear(new_vma, VM_PAD_MASK);/                new_vma->vm_flags \&= ~VM_PAD_MASK;/' mm/mmap.c
         echo "MMAP_VM_FLAGS_FIX=true" >> "$GITHUB_ENV"
 
-    - name: 'Fix selinux_hide pointer-bool-conversion on 6.6+'
-      shell: bash
-      run: |
-        set -euo pipefail
-        KVER="${{ inputs.kernel_version }}"
-        # version >= 6.6 ? apply to ALL flavors/branches (kernelsu/next/resukisu, any GKI)
-        if [ "$(printf '%s\n' "6.6" "$KVER" | sort -V | head -n1)" = "6.6" ]; then
-          echo "[INFO] KVER $KVER >= 6.6, checking selinux_hide.c (all branches)"
-          # Search workspace-wide so we catch kernel/common/drivers/kernelsu, common/drivers/kernelsu, kernel/KernelSU, etc.
-          for f in $(find "${{ github.workspace }}" -name selinux_hide.c 2>/dev/null); do
-            if grep -q "security_dump_masked_av_fn" "$f" && grep -q "if (security_dump_masked_av_fn)" "$f"; then
-              echo "[INFO] Patching $f (security_dump_masked_av_fn)"
-              sed -i 's/if (security_dump_masked_av_fn)/if (security_dump_masked_av_fn != NULL)/g' "$f"
-              sed -i 's/if (context_struct_compute_av_fn)/if (context_struct_compute_av_fn != NULL)/g' "$f"
-              echo "SELINUX_HIDE_FIX=patched:$f" >> "$GITHUB_ENV"
-            else
-              echo "[INFO] $f already patched or no pattern"
-            fi
-          done
-          if [ -z "${SELINUX_HIDE_FIX:-}" ]; then
-            echo "[INFO] No selinux_hide.c needing patch found"
-            echo "SELINUX_HIDE_FIX=not_needed" >> "$GITHUB_ENV"
-          fi
-        else
-          echo "[SKIP] KVER $KVER < 6.6, no selinux_hide fix (covers all branches)"
-          echo "SELINUX_HIDE_FIX=skipped" >> "$GITHUB_ENV"
-        fi
-
     - name: 'Final Kernel Fixes Summary'
       shell: bash
       run: |

.github/workflows/build.yml

@@ -174,6 +174,27 @@ jobs:
         flavor: ${{ inputs.root_flavor }}
         commit: ${{ inputs.root_commit }}
 
+    - name: Fix selinux_hide pointer-bool-conversion on 6.6+ (ALL branches)
+      shell: bash
+      run: |
+        set -euo pipefail
+        KVER="${{ inputs.kernel_version }}"
+        if [ "$(printf '%s\n' "6.6" "$KVER" | sort -V | head -n1)" = "6.6" ]; then
+          echo "[INFO] KVER $KVER >= 6.6, patching selinux_hide.c (all flavors/branches)"
+          for f in $(find "${{ github.workspace }}" -name selinux_hide.c 2>/dev/null); do
+            if grep -q "if (security_dump_masked_av_fn)" "$f"; then
+              echo "[INFO] Patching $f"
+              sed -i 's/if (security_dump_masked_av_fn)/if (security_dump_masked_av_fn != NULL)/g' "$f"
+              sed -i 's/if (context_struct_compute_av_fn)/if (context_struct_compute_av_fn != NULL)/g' "$f"
+              echo "[OK] Patched $f"
+            else
+              echo "[INFO] $f already patched"
+            fi
+          done
+        else
+          echo "[SKIP] KVER $KVER < 6.6"
+        fi
+
     - name: Disable SUSFS for ReSukiSU without SUSFS feature
       if: ${{ inputs.root_flavor == 'resukisu' && !contains(inputs.feature_set, 'SUSFS') }}
       uses: ./.github/actions/set-kernel-config