fix(update): keep Xray-core running until update downloads finish (#7002)

UpdateXray stopped the core before downloading, which also stopped the Panel Traffic Outbound bridge the download needed on servers that reach GitHub only through it, leaving every client offline. The new core is now downloaded, staged and checked with run -test against the current config while the old one serves; only the rename and restart swap it (Windows still stops first). update.sh gets the bridge as XUI_UPDATE_PROXY, installs x-ui.sh from the release archive, and fetches Alpine's x-ui.rc before stopping x-ui.

internal/xray/kernel_tun.go

@@ -0,0 +1,45 @@
+package xray
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/util/json_util"
+)
+
+// ForceUserspaceWireGuardTun sets noKernelTun on every WireGuard outbound and returns the tags
+// it changed. Values stay raw so the template's other keys reach the core byte for byte.
+func ForceUserspaceWireGuardTun(raw json_util.RawMessage) (json_util.RawMessage, []string) {
+	var outbounds []map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &outbounds); err != nil {
+		return raw, nil
+	}
+	var moved []string
+	for _, ob := range outbounds {
+		var protocol string
+		if json.Unmarshal(ob["protocol"], &protocol) != nil || !strings.EqualFold(protocol, "wireguard") {
+			continue
+		}
+		var settings map[string]json.RawMessage
+		if json.Unmarshal(ob["settings"], &settings) != nil || settings == nil {
+			continue
+		}
+		wasUserspace := string(settings["noKernelTun"]) == "true"
+		settings["noKernelTun"] = json.RawMessage("true")
+		rewritten, err := json.Marshal(settings)
+		if err != nil {
+			continue
+		}
+		ob["settings"] = rewritten
+		if !wasUserspace {
+			var tag string
+			_ = json.Unmarshal(ob["tag"], &tag)
+			moved = append(moved, tag)
+		}
+	}
+	rewritten, err := json.Marshal(outbounds)
+	if err != nil {
+		return raw, nil
+	}
+	return rewritten, moved
+}