Add code-virtualization/custom-linker reference, doctor and so_constpatch tools

New reference: references/code-virtualization-and-custom-linkers.md
  Covers the layer between "packed" and "clean" - manifests whose Application is the
  app's own and whose dex is readable, yet a re-signed build dies before user code runs.
  Contents: three cheap identification tells (whole classes as native declarations, the
  registerNativesForClass/special_clinit pair, SONAME-vs-filename mismatch); the
  keep-the-library / delete-the-library deadlock and why both routes fail; the
  checker-vs-implementation question that resolves it; the string-redirect technique
  (equal-length rewrite of an isolated constant so a loadLibrary call reaches an
  already-mapped library, so no offsets move and no death path needs neutralizing);
  expected private-loader log shapes; a single-variable experiment to determine whether
  the native check reads in-APK certificate material or the PMS-reported signature; and
  why a Java-layer signature killer logging success proves nothing.

New tool: scripts/doctor.py
  Cheapest first command. Capability report and per-script runnability, with
  APKREV_TOOLS support so tools installed off-PATH or as runnable jars are found rather
  than reported missing. Surfaces the environment facts that silently poison
  experiments: clock skew, leftover adb forward entries, a leftover device proxy, and a
  frida process already running on the device (which makes the target look like it
  detects instrumentation when nothing has been attached yet).

New tool: scripts/so_constpatch.py
  Implements the string-redirect technique. Enforces equal length, refuses to patch a
  substring of a longer identifier, reports whether each hit sits in an ELF constant
  pool, and patches inside an APK or a bare .so. Field-tested on a real protected
  library: find, equal-length replace, unequal-length refusal, multi-hit guard, --force
  and absent-name paths all verified.

Updated:
  SKILL.md            fix question count (ten -> thirteen); index the new reference and
                      both new scripts; make doctor.py the first step of the workflow;
                      add the "no packer but still dying" pointer during recon
  packers.md          cross-reference the new layer so "no packer" is not read as
                      "editable"
  ad-removal.md       make log evidence a count rather than an impression (n -> 0 is a
                      measurement; a tag that goes quiet without reaching zero is a
                      weaker result)
  repack-and-sign.md  warn that a full apktool rebuild rewrites obfuscated resource
                      paths (hundreds of rename pairs) - a tool artifact that must not be
                      read as breakage - and prefer a dex-only swap when that is the only
                      edit
  pitfalls.md         generalize the ServiceLoader example so it is not tied to one
                      sample's third-party library
  README.md           document the new files and scripts; document APKREV_TOOLS and the
                      cross-platform intent

references/pitfalls.md

@@ -18,15 +18,20 @@ App dies immediately on launch. Sometimes a different `ClassNotFoundException` f
 **Root cause**
 `META-INF/` is not only signatures. It holds **ServiceLoader registrations** that Android reads at runtime. Deleting the directory to prepare for re-signing deletes them too.
 
-Real examples found in one APK:
+Real examples found in one APK (framework entries first — these are the ones that produce the
+confusing `ClassNotFoundException`; note that **third-party libraries register the same way**, so the
+list is not limited to well-known frameworks):
 ```
 META-INF/services/kotlinx.coroutines.internal.MainDispatcherFactory  -> kc
 META-INF/services/io.ktor.client.engine.HttpClientEngineContainer    -> OkHttpEngineContainer
 META-INF/services/io.ktor.serialization.kotlinx.KotlinxSerializationExtensionProvider
 META-INF/services/kotlinx.coroutines.CoroutineExceptionHandler       -> wc
-META-INF/services/com.arialyy.aria.core.inf.IUtil
-META-INF/services/com.arialyy.aria.core.listener.IEventListener
+META-INF/services/<third-party-package>.<SomeInterface>              -> <impl class>
+META-INF/services/<third-party-package>.<SomeListener>               -> <impl class>
 ```
+The last two are the general shape, not a coincidence: a downloader, an HTTP engine, a serialization
+provider or a plugin SPI shipped as a library all land here, and any of them can be the one whose
+absence kills startup.
 
 **Why it is hard to see**
 The error message names Kotlin coroutines, not your repack. You will spend an hour blaming the dex.