Hide a fixed set of well-known root and hook packages

With per-app configuration gone, the hidden list is the same for every app
and can't be edited at runtime, so it carries the well-known names instead
of only KernelSU, Magisk and Veil. 28 packages plus Veil, grouped in
Features.kt:

- root managers: Magisk, Magisk Delta, Magisk Alpha, KernelSU, KernelSU
  Next, SukiSU Ultra, APatch
- module managers and helpers: MMRL (both variants), Magisk Module
  Manager, KsuWebUI
- hook frameworks and managers: Vector, LSPosed, LSPatch, EdXposed,
  Xposed installer, Taichi, VirtualXposed, Substrate
- older su apps and one-click root tools

Packages that aren't installed match nothing, so a name that's wrong or
absent is harmless. Most names were not checked against an install; only
KernelSU and MMRL were present on the test device. Xposed modules in
general have no common package name, so they stay uncovered by name.

The settings screen shows the count and puts the list behind a toggle.
Verified on device with Veil Probe: the installed ones (KernelSU and both
MMRL packages) report HIDDEN across all ten lookups, no LEAK/FAIL/ERROR,
and a scoped app still starts.

Co-Authored-By: agent <agent@bdeshi.space>

README.md

@@ -34,9 +34,13 @@ Every app in scope gets all of these. Veil's settings screen is a read-only summ
 | USB / wireless debugging | `adb_enabled` / `adb_wifi_enabled`                     |
 | Developer options        | Developer Options enabled state                        |
 | Mock location            | Legacy pre-Marshmallow flag only                       |
-| Root / manager apps      | Fixed list: KernelSU, Magisk, Veil itself              |
+| Root / manager apps      | Fixed list of ~30 packages (see `Features.kt`)         |
 | Build tags/type          | Real build swapped for `release-keys` / `user`         |
 
+The package list covers root managers (Magisk and forks, KernelSU and forks, APatch), module
+managers, hook frameworks and their managers, and older su apps, plus Veil itself. Xposed modules in general have no common package name, so they
+aren't covered by name.
+
 Doesn't cover native-level root/hook detection or remote attestation (Play Integrity,
 SafetyNet) — that's your Zygisk implementation's job, not Veil's.