Bug fixes, new transform passes, test coverage, and CI tooling

Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.

pkg/strenc/keyderive.go

@@ -3,13 +3,8 @@ package strenc
 import (
 	"crypto/hmac"
 	"crypto/sha256"
-	"encoding/binary"
-	"os"
-	"runtime"
 )
 
-const buildSeed = 0xDEAD_BEEF_CAFE_BABE
-
 func DeriveMasterKey(seed [32]byte) [32]byte {
 	var out [32]byte
 
@@ -24,25 +19,3 @@ func DeriveMasterKey(seed [32]byte) [32]byte {
 
 	return out
 }
-
-func DeriveFromBinary() [32]byte {
-	exePath, err := os.Executable()
-	if err != nil {
-		exePath = "unknown"
-	}
-
-	mac := hmac.New(sha256.New, []byte("strenc.binary.seed"))
-	mac.Write([]byte(exePath))
-
-	var seedBuf [8]byte
-	binary.LittleEndian.PutUint64(seedBuf[:], buildSeed)
-	mac.Write(seedBuf[:])
-
-	mac.Write([]byte(runtime.GOOS))
-	mac.Write([]byte(runtime.GOARCH))
-
-	var seed [32]byte
-	copy(seed[:], mac.Sum(nil))
-
-	return DeriveMasterKey(seed)
-}