Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

README.md

@@ -575,18 +575,53 @@ The `make compare` target verifies all of these are hidden in the obfuscated bin
 
 ```bash
 # Run all package tests
-go test ./pkg/...
+go test ./...
 
-# VM tests (23 tests: arithmetic, bitwise, comparisons, jumps, callouts, determinism, junk opcodes)
-go test ./pkg/vm/ -v
+# Run all tests fresh (no cache)
+go test -count=1 ./...
 
-# Syscall obfuscation tests
-go test ./pkg/syscallobf/ -v
-
-# Vet all source
-go vet ./...
+# CI gate: vet + test in one step
+make verify
 ```
 
+### Test Coverage
+
+| Package | Tests | Focus |
+|---|---|---|
+| `internal/transform` | 28 | MBA, constant blinding, fake signatures, function splitting, basic-block reorder, opaque predicates, junk strings, splice, dead code |
+| `pkg/strenc` | 7 | Per-binary key derivation, XOR stream, seed determinism |
+| `pkg/stringcrypt` | 7 | CFB mode round-trip, padding, tamper detection |
+| `pkg/pageman` | 14 | Page alignment, mprotect guards, size math, write-after-guard |
+| `pkg/integrity` | 14 | SHA-256 of binary, hash hex round-trip, `ClearExpectedHash` for runtime toggling |
+| `pkg/pclntab` | 12 | `readUint` bounds (incl. negative offset), parser validation, scramble, corrupt, encrypt |
+| `pkg/antisandbox` | 6 | Hostname/MAC lists, `Check`/`CheckNetwork` delegation, no-panic on non-Linux |
+| `pkg/antiemul` | 6 | `Check`/`checkCoreCount`/`checkMemory`/`checkUptime`/`checkTiming` no-panic; 1M-iter timing guard |
+| `pkg/vm` | 21 | Arithmetic, bitwise, comparisons, jumps, callouts, determinism, junk opcodes |
+| `pkg/syscallobf` | 3 | Syscall number resolution, table integrity |
+
+Packages without tests: `pkg/antidbi`, `pkg/antidebug`, `pkg/antivm`, `pkg/typewipe`, `cmd/*`. These rely on the platform-specific or runtime-coupled nature of their operations.
+
+### Makefile Targets
+
+```bash
+make help        # List all targets with descriptions
+make all         # Build obfuscated binary (default)
+make obfuscated  # Full pipeline: transform + garble + integrity hash
+make normal      # Build unobfuscated binary for comparison
+make compare     # Build both and print size/symbol/string comparison
+make transformer # Build only the transformer tool
+make inthash     # Build only the integrity hash tool
+make run         # Build and run obfuscated binary
+make run-normal  # Build and run unobfuscated binary
+make test        # Run all package tests
+make verify      # go vet + go test (CI gate)
+make lint        # gofmt + go vet
+make fmt         # gofmt -w on all sources (skips build/)
+make clean       # Remove build artifacts
+```
+
+Note: `make vet` runs `go vet -unsafeptr=false` — the only legitimate `uintptr→pointer` conversion in the project is the darwin antidebug hook in `pkg/antidebug/antidebug_hook_darwin.go`, which reads function prologues for debugger detection.
+
 ## Requirements
 
 - Go 1.26.3+ (darwin/arm64 or linux/amd64)