Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

pkg/integrity/integrity.go

@@ -27,12 +27,24 @@ func SetExpectedHash(hash [32]byte) {
 	hashIsSet = true
 }
 
+// ClearExpectedHash disables integrity verification until the next
+// SetExpectedHash call. Use this in test teardown or runtime toggles.
+func ClearExpectedHash() {
+	mu.Lock()
+	defer mu.Unlock()
+	expectedHash = [32]byte{}
+	hashIsSet = false
+}
+
 func SetExpectedHashHex(hex string) error {
+	if len(hex) != 64 {
+		return fmt.Errorf("integrity: invalid hash hex length %d, want 64", len(hex))
+	}
 	var hash [32]byte
 	for i := 0; i < 32; i++ {
 		_, err := fmt.Sscanf(hex[i*2:i*2+2], "%x", &hash[i])
 		if err != nil {
-			return fmt.Errorf("integrity: invalid hash hex: %w", err)
+			return fmt.Errorf("integrity: invalid hash hex at byte %d: %w", i, err)
 		}
 	}
 	SetExpectedHash(hash)