Add Dart AOT depth (reference + 3 scripts); fix encoding rule and add P26

New reference:
- dart-aot.md: pinning the Dart version, building a matching decompiler, the object-pool
  model and reference indexes, register/boolean conventions, the three assembly signatures
  that identify most business logic, the locating workflow, patch strategy, and the traps
  specific to this layer (including ambiguous identifiers that resolve to protocol fields).

New scripts (parameterized, no machine-specific paths):
- dart_pprefs.py: object-pool offset -> code-site index, decoded arithmetically. Avoids the
  full-capstone pass that costs minutes and 1-2 GB and reads as a hang.
- dart_pool_strings.py: framed literal recovery with file offsets. Defaults to one-byte
  because automatic two-byte (UTF-16) detection is unreliable; --find searches both
  encodings and is the reliable way to locate a known literal.
- dart_disasm.py: annotated windowed disassembly (pool + boolean annotations) and a B/BL
  caller index that needs no disassembler.

Fixes and integration:
- framework-runtimes.md: point the Dart depth at dart-aot.md, and make the string-encoding
  rule precise (ASCII is one-byte/UTF-8; CJK is UTF-16LE) instead of leaving it as 'try both'.
- pitfalls.md: P26 -- self-built tooling that fails in a way that reads as a target finding
  (silent arithmetic, helper shadowing a stdlib module, measuring against an incomplete
  reference, and a knob that does not move the metric).
- SKILL.md / README.md: index the new reference and scripts.

Validated by running all three scripts against a real Dart AOT sample: the pool-ref index
agrees with an independently built index to 99.2%, and the literal extractor's one-byte
output was verified string-by-string against a decompiler's pool listing.

README.md

@@ -41,6 +41,9 @@ references/               loaded on demand, one topic each
                               boundary with single-variable tests, choosing a native host
   framework-runtimes.md       Flutter / React Native / Unity: which layer owns the UI, and how to
                               find logic when there are no symbols (string encoding traps)
+  dart-aot.md                 Dart AOT in depth: version pinning and building a matching decompiler,
+                              the object pool and reference indexes, register/boolean conventions,
+                              the three signatures that identify business logic, locating, patching
   native-and-so.md            .so hosts, DT_NEEDED vs JNI_OnLoad, relocation limits,
                               relocation-free bootstrapping, replacing Java methods natively,
                               and which ABI/library is *actually loaded and executing*
@@ -67,6 +70,10 @@ scripts/                  parameterized, path-agnostic
   dex_strpatch.py             byte-level string patch with a string_ids ordering guard
   dex_classdiff.py            prove a dex edit was surgical
   dex_strings.py              strings/URLs/SDK markers without a decompiler
+  dart_pool_strings.py        recover literals from a Dart AOT snapshot (framed entries, the
+                              one-byte vs UTF-16 split, file offsets, run-length noise filter)
+  dart_pprefs.py              build/query the object-pool -> code-site index for a Dart snapshot
+  dart_disasm.py              annotated windowed disassembly of Dart AOT code + B/BL caller index
   find_refs.py                count callers of a method before patching it
   repack.py                   rebuild APK, strip only signatures, sign, verify
   devsh.py                    quoting-safe ADB shell helper