`set_system_proxy` via `rish` never works on SFA

set_system_proxy via rish never works on SFA

Env: SFA + Shizuku, config
inbounds: [{type:"mixed", listen:"127.0.0.1", listen_port:7777, set_system_proxy:true}], no tun.

Expected: NewSystemProxy finds exported rish + rish_shizuku.dex
and runs settings put global http_proxy with shell privilege (no VPN slot).

Actual: always root or system (adb) permission is required for set system proxy,
no matter where the files are placed (files/, cache/, external files/,
sing-box/ subdirs, correct uid/gid/context/perms).

Root cause (core):

1. common/settings/proxy_android.go:23 relies on C.FindPath("rish").
2. constant/path.go:30 + constant/path_unix.go:9 only search
   [".", "/etc", "/usr/share", "/usr/local/etc", "/usr/local/share"]
   (plus HOME-based entries if HOME is set).
3. On GOOS=android (Unix branch, Go os/file.go:531),
   UserCacheDir/UserConfigDir require XDG_*/HOME.

Trigger (SFA app, SagerNet/sing-box-for-android):
Application.kt:57-108 passes basePath/filesDir, workingPath/externalFiles,
tempPath/cacheDir to libbox Setup, but never sets HOME/XDG_* nor
chdirs (libbox/setup.go has no Chdir; sWorkingPath ≠ process cwd,
usually /). Hence FindPath can never hit any app directory.

Suggest (either side fixes it):

• core: resolve rish via filemanager.BasePath/sWorkingPath,
  or add a rish_path option / absolute-path support;
• app: setenv("HOME", basePath) (or cwd → workingPath) on startup.

Start with common/settings/proxy_android.go and constant/path.go plus constant/path_unix.go to trace how FindPath locates rish. Compare those assumptions with Application.kt:57-108 and libbox/setup.go, then reproduce the supplied SFA configuration. Done means set_system_proxy discovers the exported rish files and applies the global proxy without requiring root, system/ADB permission, or a VPN slot.