Zupt v2.1.1: fix cross-arch build issues, eliminate UB, improve Android/Termux support

- Removed all shipped .o files from tarball (fixes aarch64/Termux linker errors with x86_64 objects)
- Added arch-safety guard in Makefile to auto-detect and remove incompatible .o files
- Switched default compiler from gcc to cc (Termux uses clang)
- Skipped -lpthread on Android (bionic provides pthreads)
- Added Android detection via uname -o
- Fixed Keccak UB: ROL64(x,0) no longer expands to undefined x >> 64
- Achieved zero UBSan/ASAN issues across all PQ crypto paths
- Moved sys/syscall.h include to file scope with proper __linux__ guard

Release stats:
- 73 files, 159KB, zero .o artifacts
- 70/70 tests passing
- Fully clean under ASAN + UBSan

Note: full-disk encryption (--disk) deferred to v2.2.0 (requires raw device I/O, sparse detection, and privilege handling)

src/zupt_crypto.c

@@ -17,6 +17,10 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#if defined(__linux__)
+  #include <sys/syscall.h>
+  #include <unistd.h>
+#endif
 
 /* ═══════════════════════════════════════════════════════════════════
  * RANDOM BYTES (OS-native CSPRNG — NO FALLBACK)
@@ -39,10 +43,11 @@ void zupt_random_bytes(uint8_t *buf, size_t len) {
     exit(1);
 #else
     /* Linux/macOS/BSD: try getrandom(2) first, then /dev/urandom */
-  #if defined(__linux__) && defined(SYS_getrandom)
-    #include <sys/syscall.h>
+  #if defined(__linux__)
+    #if defined(SYS_getrandom)
     ssize_t r = syscall(SYS_getrandom, buf, len, 0);
     if (r == (ssize_t)len) return;
+    #endif
   #endif
     FILE *f = fopen("/dev/urandom", "rb");
     if (f) {

src/zupt_keccak.c

@@ -50,7 +50,7 @@ static const int KECCAK_PI[25] = {
     14, 24,  9, 19,  4
 };
 
-#define ROL64(x, n) (((x) << (n)) | ((x) >> (64 - (n))))
+#define ROL64(x, n) ((n) ? (((x) << (n)) | ((x) >> (64 - (n)))) : (x))
 
 /* ═══════════════════════════════════════════════════════════════════
  * KECCAK-f[1600] PERMUTATION (24 rounds)