Add native tamper/suicide guidance, toolchain map, and three scripts

references/native-tamper-and-suicide.md - how a hardened library terminates its own process: the mechanisms and their signatures, how to tell which one actually fires, arranged faults that call nothing (defeating every PLT-level fix), resolving a stub to its symbol, forged section headers, function boundaries from PT_GNU_EH_FRAME, scanner traps, and neutralising by returning rather than spinning.

references/toolchain.md - what to install, non-interactive invocation, GUI-only tools (ask for a human instead of silently substituting a weaker method), version-alignment traps, and working offline.

scripts/elf_plt.py - PLT stub to imported symbol on x86_64 and aarch64 from the relocation table; caller listing; library byte-diff naming each changed stub's symbol. scripts/apk_diff.py - entry-level diff by content hash, so same-size replacements are caught. scripts/native_crash.py - locate a native death from a log or tombstone and flag an arranged fault.

pitfalls P31-P36; SKILL.md gains a decision question, a hard constraint on neutralising terminate paths, and cross-references from packers/native-and-so.

references/packers.md

@@ -134,6 +134,13 @@ The cheapest high-value experiment, and one that is routinely skipped: run the *
 build** and the **repackaged build** through the *same* probe and diff what differs. The difference is
 your detection signal. Doing this early is far cheaper than enumerating candidate checks one by one.
 
+**When the symptom is a death rather than a dialog** — the process disappears, hangs, or dies at a
+roughly constant time after launch — the check is not drawing anything, it is terminating. The
+question then becomes *which mechanism*, and the answer decides the whole approach:
+`native-tamper-and-suicide.md` covers how to tell an imported terminate call from an **arranged
+fault** (which calls nothing and therefore defeats every PLT-level fix), how to find the site, and
+why making a routine "not return" freezes the process instead of suppressing the check.
+
 ## Reporting
 
 State the boundary you measured, the evidence for each entry, and what remains untested. "The shell