Restructure SKILL.md as a gated procedure, not advice

Why
  The reference material was good and mostly went unread in practice. The failure mode was
  not ignorance - it was reading the file, agreeing with it, and then reasoning from first
  principles anyway, because everything in it was phrased as guidance. Guidance can be
  acknowledged and set aside; a gate cannot be cleared without doing the thing.

SKILL.md is now a procedure
  New top matter, in the order a reader meets it:
  - "How to use this file" states plainly that this is a procedure with gates, that this
    file wins over intuition until evidence overrides it, and why (every rule is residue
    of a failure that cost hours).
  - Four override rules R1-R4, each with a one-line claim, the concrete trap, and a
    pointer. R1 deliverable-as-a-testable-sentence, R2 one variable plus a control build,
    R3 never ship or claim an unverified artifact, R4 identify the owning layer and
    re-classify when reality disagrees.
  - The symptom index is retitled "a matching row is a stop signal" and now carries an
    explicit instruction: load the file before your next command, not after your next
    three attempts.
  - Four gates G1-G4, each an action with a pass criterion and a fail description:
    deliverable form, environment truth (doctor.py + preflight), code location (including
    the virtualization check even when recon says "no packer"), and baseline/control with
    recorded time-to-death.
  - The workflow gains a skip-condition line per step ("it seems unnecessary" is not a
    condition) and a two-strike rule: two failures of the same shape mean the model is
    wrong, not the parameters, so re-classify instead of running a third variant.
  - New "What done means": six items, all required, with an explicit rule that a clean log
    is not evidence and that anything short of six is a checkpoint to be labelled as one.
  - New "Stop conditions": the six moments where pushing forward is the wrong move -
    repeated same-shape failure, a no-effect patch about to be retried, an unexplained
    failure, an unproven "blocked" verdict, a success claimed from absence of errors, and
    a measurement that disagrees with a settled conclusion.

README
  Documents the gated design and why it exists, and tells an agent reading it what to act
  on rather than read: the four rules, the symptom index as a stop signal, the gates, the
  two-strike rule, and the definition of done. Points at scripts/doctor.py as the cheapest
  first command.

Not changed
  Three section references (`ad-removal.md` server-driven, `recon.md` code-location,
  `dex-patching.md` finding-the-call-site) do not match a `##` heading textually. Each
  target does exist - two are bolded inline subheadings and one is "## Finding the call
  site" - so they resolve for a reader. Left alone deliberately: rewriting them would add
  churn without changing behaviour.

README.md

@@ -9,6 +9,34 @@ organized for progressive disclosure — a short decision-oriented `SKILL.md`, d
 references loaded only when a step needs them, and parameterized scripts you can run
 directly.
 
+## How an agent is expected to consume this
+
+`SKILL.md` is deliberately written as a **procedure with gates** rather than as advice, because the
+observed failure mode is not ignorance — it is a model reading the whole thing, agreeing with it, and
+then reasoning from first principles anyway.
+
+So there are four things in the body that are meant to be *acted on*, not read:
+
+- **Four override rules (R1–R4).** Where they conflict with the current plan, they win until evidence
+  overrides them.
+- **A symptom index.** Each row is a failure that has already been paid for. **A matching row is a
+  stop signal**: load that file before running another command, rather than after a few more attempts.
+  Reasoning past a known symptom is how the same hours get spent twice.
+- **Four gates (G1–G4),** each an action with a pass criterion. "I understand the idea" does not clear
+  a gate. They exist so that classification, environment truth and a control build happen *before*
+  the first patch, not after the third failure.
+- **A two-strike rule and stop conditions.** Two failures of the same shape mean the model is wrong,
+  not the parameters. The third variant of a hypothesis that already failed twice is where rounds go
+  to die.
+
+And one thing at the end that is meant to be *withheld*: **"done"** has a definition (six items). A
+clean log is not one of them. Anything short of all six is a checkpoint, and should be reported as a
+checkpoint with what remains.
+
+If you are an agent reading this: the cheapest possible first command is
+`python scripts/doctor.py`. It tells you which of these tools exist here, which scripts can actually
+run, and whether something in the environment is already poisoning your measurements.
+
 ## What it is good at
 
 - Deciding **fast** whether a request is even achievable client-side, instead of
@@ -49,7 +77,13 @@ directly.
 ## Structure
 
 ```
-SKILL.md                  decision tree, workflow, hard constraints, indexes
+SKILL.md                  a procedure with gates, not background reading:
+                          how-to-use  -> four override rules (R1-R4)
+                          symptom index (a matching row is a stop signal)
+                          four gates (G1-G4, actions with pass criteria)
+                          thirteen classification questions
+                          the workflow, with a per-step skip condition and a two-strike rule
+                          what "done" means  ->  stop conditions  ->  constraints  ->  indexes
 references/               loaded on demand, one topic each
   recon.md                    identify packer, SDKs, code location, tamper checks; unpacking
   packers.md                  hardened targets: rejection signals, measuring the validation