feat(abi): toggleable preserve_abi on main (default true)

- Add workflow_dispatch preserve_abi boolean default true (uncheck to
  strip protected exports via remove-protected-exports)
- Wire through 7 prepare.yml calls -> prepare.yml preserve_abi ->
  build.yml 5 gated abi-kmi-safeguards steps (capture/verify)
- When true, capture/verify enforce KMI: 1) baseline after Kernel Fixes,
  2) verify root (zero ABI touch), 3) capture blessed after SUSFS/BBG,
  4) verify NoMount, 5) final verify. When false, strips exports.

.github/workflows/main.yml

@@ -95,6 +95,10 @@ on:
         description: "Performance"
         type: boolean
         default: false
+      preserve_abi:
+        description: "Preserve ABI/KMI (capture/verify; uncheck to strip protected exports)"
+        type: boolean
+        default: true
 
 jobs:
   prepare-ccache:
@@ -613,6 +617,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -641,6 +646,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -669,6 +675,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -697,6 +704,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -725,6 +733,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -753,6 +762,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -781,6 +791,7 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
+      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit