Add patch-audit reference; extend pitfalls to P30; unify script docs in English

- references/patch-audit.md (new): two independent questions for any self-made patch —
  did it land, and is it legal. Length-vs-bytes comparison and the ~800-false-positive
  signal that makes byte diffing useless; the equal-length-replacement blind spot that
  hides patches from length-only audits (and why tier-2 checking must be driven by the
  patch set's own declared targets, not by tier-1 output); verifier-level legality
  (move-result must immediately follow its producer) checked as a set-difference so it
  runs before the device; text-matching patch traps (whitespace, line endings,
  instruction names, anchor uniqueness, re-emitted old fragments, one block per doc);
  and auditing the patch set rather than a patch.
- pitfalls P28-P30: stale events-buffer records that read as this build's crash;
  a patch that lands and changes nothing because the edited data is not the data the UI
  consumes; two observations that cannot distinguish the hypotheses reported as a result.
- verification.md: point the known code-item blind spot at the new reference.
- Unify the four remaining script docstrings (and their inline comments) into English,
  and generalise a sample-specific class name out of one of them.

scripts/dex_classdiff.py

@@ -1,11 +1,16 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
-"""对比两个 dex 的 class_defs：类名 + access_flags（重点看 ACC_INTERFACE 0x200）。
+"""Diff two dex files at the class_defs level: class names + access_flags.
+The interesting flag is ACC_INTERFACE (0x200).
 
-用途：验证 baksmali -> smali 整树往返是否损伤了 dex 的 interface/class 关系。
-ICCE "Found interface X, but class was expected" 就是这类损伤的典型症状。
+Use it to prove that a disassemble -> reassemble round-trip did not damage the dex's
+interface/class relationships. The classic symptom of that damage is
+IncompatibleClassChangeError ("Found interface X, but class was expected") at runtime.
 
-用法：python dex_classdiff.py <a.dex> <b.dex> [过滤子串]
+Important limitation: this check compares tables only. It cannot see code-item damage —
+see references/patch-audit.md for the checks that can.
+
+Usage: python dex_classdiff.py <a.dex> <b.dex> [filter-substring]
 """
 import struct
 import sys