Absorb the jsvmp series: JS VMP recovery, and a round-trip-tested loader decoder

A new documented route for logic protected as a private JS opcode stream (jsvmp):
recognition signals, the call-it-first route, stack- and register-machine reading,
AST instruction extraction, the four JS evaluation traps, constant folding and
control-flow recovery. Every procedure is inferred (absorbed from three public
write-ups, anonymized; none run on a real target) and labelled so.

The one shipped piece is the loader decoder (base64 -> varint -> ZigZag), measured
against its own round trip (2,016 values exact, canonical varint/ZigZag layouts
pinned, truncation raises) and it decodes the write-up's own sample literal end to
end. Wired into the symptom index, routing tables, coverage ledgers and the
capability matrix; RN/Hermes still not covered, with the jsvmp carve-out stated.

Also clears two warnings: an E302 in the new script, and the long-standing
check_commands warning where a tool-verification transcript quoted check_budget.py
with its result inline (annotations moved to a continuation line, content intact).

Ran: check_repo/check_refs/check_routing/check_commands/check_budget (all exit 0),
flake8 clean, pytest 763 passed / 199 skipped / 25 xfailed.

docs/tool-verification/EXTENSION-test-harness.md

@@ -128,7 +128,8 @@ and every command it runs was executed by hand on this machine:
 
 ```
 $ python check_refs.py          exit 0                             observed
-$ python check_budget.py        exit 0  ("0 failure(s), 0 warning(s), 3 note(s)")   observed
+$ python check_budget.py
+    exit 0  ("0 failure(s), 0 warning(s), 3 note(s)")   observed
 $ python check_repo.py          exit 0  (with PYTHONUTF8=1; see §5.1)               observed
 $ python -m pytest -q           exit 0  ("596 passed, 153 skipped, 26 xfailed")     observed
 ```