Measure the toolkit on a real Flutter target and correct what it claimed

Ran the scripts against a real Flutter AOT / multi-dex / 36-.so APK (Dart 3.6.0,
com.tingfeng.tool) and recorded what each one actually did. Two of them were wrong
in the direction that reads as a target finding, one Coverage claim overstated what
ships, and four documentation statements were false.

Fixed:

  dart_pprefs.py decoded only the general-purpose register file, so `ldr dN,[x27,#imm]`
  (0xFD400000) was never matched and every double constant read from the object pool
  was dropped -- 302 pool offsets and 1802 sites on this sample, one of them with 150
  references that would have been reported as zero. The documented advice is to count
  references before editing a shared constant, so a one-sided quiet gap here produces
  exactly the wrong decision. Now covers both register files; a purpose-written
  arbiter agrees with it to 0/0 across .text, against 0/302 before.

Documented but deliberately not fixed, because a fix would not have been run:

  elf_plt.py misses the last PLT stub slot (`off < fsz - 16`), which on libloader.so
  turned a real, called import (dl_iterate_phdr) into "not a resolved stub".
  find_refs.py advertises dex-directory input but iter_files() accepts only .smali,
  so it answers "no references" with exit 0 for input it never read.
  so_constpatch.py's rebuild drops the zip `extra` field and destroys 4 KB alignment.
  Each has its root cause and fix sketch recorded.

Documentation corrections in dart-aot.md:

  blutter's asm/ does contain full instruction listings with pool annotations -- the
  file said to ignore it, and it is the richest artifact in the chain.
  The first build costs ~78 s, not "tens of minutes"; MSVC 19.34 suffices, not VS 2022.
  The file-PP offset mapping is not recoverable from the binary (4241 shared strings,
  4237 distinct deltas), so a snapshot-decoding front end is a dependency, now stated.
  Documented aotopsy as the no-toolchain route, and the trap that its version label is
  a structural profile name (it says 3.6.2 for a 3.6.0 snapshot).

Coverage now separates what was measured from what is inferred, names blutter/aotopsy
as a prerequisite instead of implying the pool decodes itself, lists the scripts this
pass did not run, and says plainly that the packer / VMP / integrity-check scenarios
were not exercised at all.

Added hand-off points for JNI, dex-observed hardening, and the existing native boundary
documents, plus docs/verification-jiongnew/ -- the evidence record, including the four
gate outputs verbatim. No second skill: the gap is one front-end dependency, not a
subject area, and relocating Flutter docs would not have supplied it.

README.md

@@ -117,7 +117,10 @@ references/               loaded on demand, one topic each
                               find logic when there are no symbols (string encoding traps)
   dart-aot.md                 Dart AOT in depth: version pinning and building a matching decompiler,
                               the object pool and reference indexes, register/boolean conventions,
-                              the three signatures that identify business logic, locating, patching
+                              the three signatures that identify business logic, locating, patching.
+                              Begins with the snapshot-decoding front end it depends on (aotopsy or
+                              blutter) because the pool listing is an input, not something this skill
+                              produces itself
   native-and-so.md            .so hosts, DT_NEEDED vs JNI_OnLoad, relocation limits,
                               relocation-free bootstrapping, replacing Java methods natively,
                               and which ABI/library is *actually loaded and executing*
@@ -318,6 +321,17 @@ React Native/Hermes bytecode internals, and defeating a server-side authority ar
 covered, and the skill is written to say so and stop rather than apply the nearest
 documented procedure to a target it was not written for.
 
+Two qualifications that the Coverage section states in full and that belong here too:
+
+- **Flutter/Dart AOT analysis has a dependency.** The workflow begins at a pool listing
+  (`pp.txt`-class output). Producing that needs a snapshot-decoding decompiler — aotopsy (a static
+  binary, no toolchain) or blutter (built from source, ~80 s) — and this repository does not contain
+  one. It is named as a prerequisite rather than left implicit.
+- **Not every claim in this repository has a run behind it.** `docs/verification-jiongnew/` records
+  what was actually measured, on which target, and with which independent cross-check; anything not
+  covered there is documented from experience and should be read as *inferred*, per this skill's own
+  claim ladder.
+
 ## Repository maintenance
 
 Three tools live at the root and are not part of the installed skill:
@@ -329,3 +343,9 @@ check_refs.py      every cross-reference that names a section of another
                    document reaches a real heading in that document
 build_scripts.py   audit for machine-specific leftovers (absolute paths, credentials)
 ```
+
+`docs/verification-jiongnew/` is not part of the installed skill either. It is the evidence record
+for one measurement pass against a real target: what each script actually did, which independent
+method confirmed it, which defects were found, and which scenarios the target could not exercise.
+It exists so the **Coverage** claims in `SKILL.md` can be checked against runs instead of trusted,
+and so the gaps are written down where the next person will find them.