Stealth PR4: replace /entrypoint.sh + stealth.rc with a Magisk module

Summary

The largest single drop in visible-from-userspace surface. Today Beetroot adds two Beetroot-specific filesystem tells (risk: High each):

• /system/etc/init/stealth.rc — a non-AOSP init file with a literal giveaway name.
• /entrypoint.sh at filesystem root — real Android images have no such file; a single stat() reveals the container.

Move both into a Magisk module: a directory under /data/adb/modules/<random>/ containing a service.d/<random>.sh script. Magisk runs service.d/*.sh during the standard post-fs-data phase under the same u:r:magisk:s0 SELinux context we use today — no custom init.rc, no /entrypoint.sh at root, and the module dir is denylist-hidden from GMS.

Scope

• Generate module.prop + service.d/<random>.sh at Docker build time with randomized IDs.
• Drop docker/stealth.rc from the Dockerfile's COPY list.
• Move entrypoint.sh (and its helper split) into the module's service.d/.
• Boot trigger changes from sys.boot_completed=1 to Magisk post-fs-data (earlier — the script must poll for Zygote start before writing the denylist; magisk-config.sh already polls, so no helper change needed).
• Land behind the opt-in BEETROOT_STEALTH_MODULE_ID flag until the CI fingerprint audit (#6 / PR7) is green for both modes.

Complexity: L.

Source: docs/design/stealth-posture.md §3.4 + §7 PR4.

Start with the Dockerfile, docker/stealth.rc, entrypoint.sh, its helper, and magisk-config.sh, then read §3.4 and §7 of docs/design/stealth-posture.md. Trace how the current boot trigger and build-time files are assembled. Done means the opt-in module flag produces randomized module files, removes the root entrypoint and custom init file, and preserves both-mode CI fingerprint coverage.