Add native tamper/suicide guidance, toolchain map, and three scripts

references/native-tamper-and-suicide.md - how a hardened library terminates its own process: the mechanisms and their signatures, how to tell which one actually fires, arranged faults that call nothing (defeating every PLT-level fix), resolving a stub to its symbol, forged section headers, function boundaries from PT_GNU_EH_FRAME, scanner traps, and neutralising by returning rather than spinning.

references/toolchain.md - what to install, non-interactive invocation, GUI-only tools (ask for a human instead of silently substituting a weaker method), version-alignment traps, and working offline.

scripts/elf_plt.py - PLT stub to imported symbol on x86_64 and aarch64 from the relocation table; caller listing; library byte-diff naming each changed stub's symbol. scripts/apk_diff.py - entry-level diff by content hash, so same-size replacements are caught. scripts/native_crash.py - locate a native death from a log or tombstone and flag an arranged fault.

pitfalls P31-P36; SKILL.md gains a decision question, a hard constraint on neutralising terminate paths, and cross-references from packers/native-and-so.

references/native-and-so.md

@@ -3,6 +3,10 @@
 Load this when the Java/dex layer is blocked or unsuitable, when you need code to run **before** the app's
 own code, or when a native library is the only editable place left.
 
+If instead the problem is that the app **dies on its own** — hangs, restarts, or crashes natively at a
+roughly constant time after launch — that is a terminate mechanism, not a hooking problem, and the
+methods differ: read `native-tamper-and-suicide.md` before this file.
+
 The Java layer is usually the right choice. Go native when you need one of these:
 
 - execution **earlier than any app code** (before `Application.onCreate`, before static initialisers),