Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

internal/transform/transform.go

@@ -36,17 +36,32 @@ type Config struct {
 	VirtualizeFunctions bool
 	AntiDisassembly     bool
 	JunkStrings         bool
+	ConstantBlind       bool
+	ApplyMBA            bool
+	FakeSignatures      bool
+	FunctionSplit       bool
+	ReorderBasicBlocks  bool
 }
 
 func DefaultConfig() Config {
 	return Config{
-		EncryptStrings:    true,
-		InjectOpaquePreds: true,
-		InjectDeadCode:    true,
-		RandomizeOrder:    true,
-		IndirectDispatch:  true,
-		BogusControlFlow:  true,
-		FlattenControl:    true,
+		EncryptStrings:      true,
+		InjectOpaquePreds:   true,
+		InjectDeadCode:      true,
+		RandomizeOrder:      true,
+		IndirectDispatch:    true,
+		BogusControlFlow:    true,
+		FlattenControl:      true,
+		SpliceCode:          true,
+		InjectBuildID:       true,
+		VirtualizeFunctions: true,
+		AntiDisassembly:     true,
+		JunkStrings:         true,
+		ConstantBlind:       true,
+		ApplyMBA:            true,
+		FakeSignatures:      true,
+		FunctionSplit:       true,
+		ReorderBasicBlocks:  true,
 	}
 }
 
@@ -115,6 +130,26 @@ func (t *Transformer) TransformFile(srcPath, dstPath string) error {
 		result = t.flattenSimpleFunctions(result)
 	}
 
+	if t.config.FunctionSplit {
+		result = SplitFunctions(result)
+	}
+
+	if t.config.ReorderBasicBlocks {
+		result = ReorderBasicBlocks(result)
+	}
+
+	if t.config.ConstantBlind {
+		result = TransformConstants(result)
+	}
+
+	if t.config.ApplyMBA {
+		result = TransformMBA(result)
+	}
+
+	if t.config.FakeSignatures {
+		result = InjectFakeSignatures(result)
+	}
+
 	if t.config.InjectBuildID && strings.HasSuffix(srcPath, "main.go") {
 		result = t.injectBuildID(result)
 	}
@@ -131,8 +166,6 @@ func (t *Transformer) TransformFile(srcPath, dstPath string) error {
 		result = t.injectJunkStrings(result)
 	}
 
-	result = SplitLongStrings(result)
-
 	if err := os.MkdirAll(filepath.Dir(dstPath), 0755); err != nil {
 		return fmt.Errorf("mkdir %s: %w", filepath.Dir(dstPath), err)
 	}
@@ -1068,13 +1101,6 @@ func extractArgNames(argStr string) []string {
 	return names
 }
 
-func trimFirstParen(s string) string {
-	if len(s) > 0 && s[0] == '(' {
-		return s
-	}
-	return "(" + s
-}
-
 func (t *Transformer) spliceCode(src string) string {
 	lines := strings.Split(src, "\n")
 	var result []string