Add Dart AOT depth (reference + 3 scripts); fix encoding rule and add P26

New reference:
- dart-aot.md: pinning the Dart version, building a matching decompiler, the object-pool
  model and reference indexes, register/boolean conventions, the three assembly signatures
  that identify most business logic, the locating workflow, patch strategy, and the traps
  specific to this layer (including ambiguous identifiers that resolve to protocol fields).

New scripts (parameterized, no machine-specific paths):
- dart_pprefs.py: object-pool offset -> code-site index, decoded arithmetically. Avoids the
  full-capstone pass that costs minutes and 1-2 GB and reads as a hang.
- dart_pool_strings.py: framed literal recovery with file offsets. Defaults to one-byte
  because automatic two-byte (UTF-16) detection is unreliable; --find searches both
  encodings and is the reliable way to locate a known literal.
- dart_disasm.py: annotated windowed disassembly (pool + boolean annotations) and a B/BL
  caller index that needs no disassembler.

Fixes and integration:
- framework-runtimes.md: point the Dart depth at dart-aot.md, and make the string-encoding
  rule precise (ASCII is one-byte/UTF-8; CJK is UTF-16LE) instead of leaving it as 'try both'.
- pitfalls.md: P26 -- self-built tooling that fails in a way that reads as a target finding
  (silent arithmetic, helper shadowing a stdlib module, measuring against an incomplete
  reference, and a knob that does not move the metric).
- SKILL.md / README.md: index the new reference and scripts.

Validated by running all three scripts against a real Dart AOT sample: the pool-ref index
agrees with an independently built index to 99.2%, and the literal extractor's one-byte
output was verified string-by-string against a decompiler's pool listing.

references/framework-runtimes.md

@@ -64,9 +64,11 @@ Establish layer ownership **before** investing in a patch direction.
 | Change a decision permanently | `libapp.so` | most direct, hardest to locate |
 | Change startup behaviour only | host native library constructor | survives runtime restarts |
 
-Editing `libapp.so` is the most durable but locating Dart AOT code is genuinely hard: strings are the
-most reliable entry, because Dart string objects and the code referencing them can be found by scanning
-the snapshot rather than by pattern-matching machine code.
+Editing `libapp.so` is the most durable but locating Dart AOT code is genuinely hard. This subject is
+large enough to have its own reference: **`references/dart-aot.md`** covers pinning the Dart version,
+building a decompiler for exactly that version, the object-pool model and how to index it, the register
+and boolean conventions, the three assembly signatures that identify most business logic, the locating
+workflow, and how to patch this layer safely.
 
 ## Locating logic without symbols
 
@@ -85,7 +87,11 @@ the snapshot rather than by pattern-matching machine code.
                     'utf-16le:', blob.find(phrase.encode('utf-16-le')))
   ```
 
-  Try both, and try a short distinctive substring rather than a long phrase.
+  Try both, and try a short distinctive substring rather than a long phrase. Which encoding applies
+  is predictable rather than random: in a Dart AOT snapshot ASCII literals are stored one-byte (a
+  UTF-8 search finds them) while CJK / non-Latin literals are UTF-16LE (a UTF-8 search returns zero).
+  `dart-aot.md` §7 gives the exact framing, and `scripts/dart_pool_strings.py --find` locates either
+  encoding by file offset.
 - **A phrase that is absent may simply never exist as one literal.** UI text is often assembled from
   fragments or templates, so "the whole sentence" can be missing while both halves are present.
   Search the shortest distinctive token, and expect the interesting anchor to be a *label* rather