Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

Makefile

@@ -9,7 +9,7 @@ SEED          := $(shell date +%s%N)
 
 GARBLE        := $(shell go env GOPATH)/bin/garble
 
-.PHONY: all clean normal obfuscated compare transformer help run run-normal
+.PHONY: all clean normal obfuscated compare transformer inthash help run run-normal test verify lint vet fmt
 
 help:
 	@echo "Targets:"
@@ -17,8 +17,13 @@ help:
 	@echo "  make normal      - Build normal binary for comparison"
 	@echo "  make compare     - Build both and compare"
 	@echo "  make transformer - Build only the transformer tool"
+	@echo "  make inthash     - Build only the integrity hash tool"
 	@echo "  make run         - Run the obfuscated binary"
 	@echo "  make run-normal  - Run the normal binary"
+	@echo "  make test        - Run all package tests"
+	@echo "  make verify      - go vet + go test (CI gate)"
+	@echo "  make lint        - gofmt + go vet"
+	@echo "  make fmt         - gofmt -w on all sources"
 	@echo "  make clean       - Remove build artifacts"
 
 all: obfuscated
@@ -113,3 +118,19 @@ run-normal: normal
 
 clean:
 	rm -rf $(BUILD_DIR)
+
+fmt:
+	@echo "=== gofmt ==="
+	@find . -name '*.go' -not -path './build/*' -print0 | xargs -0 gofmt -l -w
+
+vet:
+	@echo "=== go vet ==="
+	go vet -unsafeptr=false ./...
+
+test:
+	@echo "=== go test ==="
+	go test ./...
+
+lint: fmt vet
+
+verify: vet test