Add patch-audit reference; extend pitfalls to P30; unify script docs in English

- references/patch-audit.md (new): two independent questions for any self-made patch —
  did it land, and is it legal. Length-vs-bytes comparison and the ~800-false-positive
  signal that makes byte diffing useless; the equal-length-replacement blind spot that
  hides patches from length-only audits (and why tier-2 checking must be driven by the
  patch set's own declared targets, not by tier-1 output); verifier-level legality
  (move-result must immediately follow its producer) checked as a set-difference so it
  runs before the device; text-matching patch traps (whitespace, line endings,
  instruction names, anchor uniqueness, re-emitted old fragments, one block per doc);
  and auditing the patch set rather than a patch.
- pitfalls P28-P30: stale events-buffer records that read as this build's crash;
  a patch that lands and changes nothing because the edited data is not the data the UI
  consumes; two observations that cannot distinguish the hypotheses reported as a result.
- verification.md: point the known code-item blind spot at the new reference.
- Unify the four remaining script docstrings (and their inline comments) into English,
  and generalise a sample-specific class name out of one of them.

README.md

@@ -61,6 +61,10 @@ references/               loaded on demand, one topic each
   tls-and-cert.md             feature-scoped network failures: expired certs, dual trust chains
   third-party-builds.md       auditing a "cracked"/"modded" APK before trusting it
   dex-patching.md             patch-layer table + dexlib2 technique in depth
+  patch-audit.md              proving a patch *landed* and is *legal*: length-vs-bytes
+                              comparison, the equal-length-replacement blind spot, verifier-level
+                              legality (move-result adjacency) checked statically, text-matching
+                              patch traps, and reporting a missing patch
   repack-and-sign.md          repack rules, unpack-and-repack, signing, post-install hazards
   runtime-data.md             DataStore / SharedPreferences / SQLite / protobuf; when the app
                               rewrites your edit, and decoding a value that looks encrypted