[DevCop95]

Hardening pass for #2. Four commits, one per theme, all gates green locally.

What this does

Fuzzing the parsers that eat attacker-influenced bytes — FuzzRegf (registry
hive), FuzzParseRep (KDC reply), FuzzUnpack (payload envelope),
FuzzMaskRoundTrip (obfuscator) and FuzzSanitizeName (persist backend). All
five consume input this tool did not author, in a process holding an elevated
token, where a panic is an availability bug and not a test artefact. The seeds
run as ordinary tests, so the corpus is exercised on every go test; CI adds a
30s-per-target smoke run on every push and PR.

SAST, with every suppression justified — gosec flagged 47 sites. None were
exploitable, but none were documented either, so each now carries an inline
//#nosec <rule> -- <reason>: protocol-mandated DES/RC4/MD5/MD4 ([MS-SAMR],
[MS-NLMP], RFC 4757), width narrowing bounded by an on-disk format, and fixed
argv in the schtasks/powershell helpers. Two rules are excluded on the
command line with their rationale written next to them: G103 (37 hand-reviewed
unsafe sites — the tool is an unsafe/syscall bridge) and G104 (14
unchecked errors, every one a deferred handle close). File modes tightened
0755/0644 → 0700/0600.

A real bug found on the way — xorBytes divided by len(key) with no
check. No caller passes an empty key today, so it was latent, but the failure
mode is a panic inside an elevated process. It now fails closed and returns
nil, letting the AEAD reject the key size.

Coverage 38% → 44.7%, floor 35 → 42 — tests for the portable hive parser,
WipeFile (including the hard-link truncate path), the collector helpers
(xorBytes, aesGCMOpen, forceCopy, truncateForLog), the persist backend,
the opt-in insecure TLS config and the elevate error paths.

A documentation bug that broke verification — docs/SIGNING.md told
verifiers to expect the certificate identity DevCop95/obliteratus, a
repository that does not exist; the workflow runs in DevCop95/pullgoscript.
The documented command therefore failed against the real v2.0.2 release. Now
corrected, with the observed output of both the passing and the failing case.

Community files — Contributor Covenant 2.1, issue forms that route
vulnerability reports to private reporting rather than the public tracker, a PR
checklist, and the CI gates documented in CONTRIBUTING.md.

Verification

gofmt -l .                                  # empty
go vet ./...                                # clean
GOOS=linux go vet ./...                     # clean (new test files compile off Windows)
staticcheck ./...                           # clean
go test ./...                               # 11/11 ok, total 44.7%
gosec -no-fail -fmt=json -exclude=G103,G104 ./...   # issues 0, nosec 47

Cross-compile was checked with GOOS=linux go vet ./... because this machine
has no Docker or working WSL; the Linux job in CI is the real confirmation.

Known limitations, stated rather than hidden

• Authenticode is still not done. It needs an EV certificate or Azure
  Trusted Signing account — paid and identity-verified — so it cannot be closed
  from here. docs/SIGNING.md now carries a status table saying exactly that
  instead of implying the artifacts are Windows-trusted. No release is blocked
  by its absence.
• gosec has a blind spot. go/types rejects the bodyless EnergyFlow
  (implemented in energyflow_amd64.s), so gosec cannot build SSA for
  internal/research and its taint rules skip that package. The job asserts
  that the missing-function-body error is the only tolerated one, so any new
  type error — which would disable analysis just as silently — fails the build.
• The new CI jobs are not yet required checks. fuzz-smoke and sast must
  be added to the main ruleset to actually block a merge.
• The new make sast / make fuzz-check / make cover targets were not
  executed here (make is not installed on this machine); each wraps a command
  that was run individually and is quoted in CONTRIBUTING.md for anyone
  without make.

Refs #2.