NDK obfuscation integration, correctness CI, and CI fixes

[quiaingmuarua]

Summary

• NDK two-step IR pipeline: integrates Kotoamatsukami into Android NDK builds via NDK clang → .bc → host opt+plugin → obf.bc → NDK clang → .so, bypassing the ABI crash caused by PGO/BOLT differences between NDK's prebuilt clang-17 and any independently-built LLVM 17
• Full 7-pass combo by default (54x IR bloat on RC4): split-basic-block → bogus-control-flow → substitution → flatten → add-junk-code → indirect-call → indirect-branch; tunable via -DKOTO_PASSES
• Obfuscation correctness check in CI: compiles RC4 plain vs obfuscated, asserts identical output — catches any pass that breaks semantics
• NDK smoke CI job: installs NDK 26, builds Kotoamatsukami.so, runs the pipeline, verifies JNI symbol is exported
• Fix two pre-existing CI failures:
  • tests/run_koto_plugin_smoke.cmake / run_koto_opt_smoke.cmake were referenced but missing
  • libhello_pass_lib.so ASAN link error fixed with -shared-libasan -shared-libubsan
• docs/ndk-obfuscation.md: pipeline diagram, pass benchmark table, per-pass explanations, customisation guide

Test plan

• build-and-test — standard build + ctest (including new plugin_koto_* smoke tests)
• build-and-test-sanitized — ASAN/UBSAN build (.so link error should now be resolved)
• ndk-obfuscation-smoke — NDK 26 build + JNI symbol verification
• Obfuscation correctness check step — RC4 output must match between plain and obfuscated

🤖 Generated with Claude Code