Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

cmd/transformer/main.go

@@ -25,6 +25,12 @@ func main() {
 	virtualizeVM := flag.Bool("vm", true, "Virtualize simple functions into VM bytecode")
 	antiDisasm := flag.Bool("anti-disasm", true, "Inject anti-disassembly patterns")
 	junkStrings := flag.Bool("junk-strings", true, "Inject junk string constants")
+	spliceCode := flag.Bool("splice", true, "Splice function bodies into fragments")
+	constBlind := flag.Bool("constblind", true, "Replace integer constants with XOR-decrypted expressions")
+	mba := flag.Bool("mba", true, "Apply Mixed Boolean-Arithmetic substitutions")
+	fakeSigs := flag.Bool("fakesigs", true, "Inject fake function signatures")
+	funcSplit := flag.Bool("funcsplit", true, "Split eligible functions into state-machine fragments")
+	bbReorder := flag.Bool("bbreorder", true, "Reorder basic blocks (swap if/else, shuffle switch cases)")
 	flag.Parse()
 
 	if *srcDir == "" || *dstDir == "" {
@@ -62,6 +68,12 @@ func main() {
 		VirtualizeFunctions: *virtualizeVM,
 		AntiDisassembly:     *antiDisasm,
 		JunkStrings:         *junkStrings,
+		SpliceCode:          *spliceCode,
+		ConstantBlind:       *constBlind,
+		ApplyMBA:            *mba,
+		FakeSignatures:      *fakeSigs,
+		FunctionSplit:       *funcSplit,
+		ReorderBasicBlocks:  *bbReorder,
 	}
 
 	t := transform.New(config)