docs+build: hygiene pass — close leak risk, de-drift docs, fix build prereqs

Repo hygiene round following a full review. No shim behaviour changes.

Leak risk:
- .gitignore: ignore CLAUDE.md (personal assistant-lane config, was one
  `git add -A` away from a public commit) and scratch_obj/.

Docs vs. reality:
- shim/README.md: rewritten. It described a pre-implementation skeleton with
  "core fns are TODO stubs returning -1005", three mutually inconsistent stub
  counts, and four completed milestones listed as open. Now carries the verified
  breakdown: 438/438 exports = 371 generated stubs + 46 core + 7 layers + 2
  Vulkan queries + 12 passthru trampolines.
- TESTING.md: dropped the self-contradicting "NOT yet" block (5 of 6 items were
  done or misstated, and contradicted the same file 45 lines above). Path B now
  points at tools/desktop-harness, which exists, instead of the orphaned
  shim/tests/harness.c. Path A prereqs marked as the record they are.
- HOST.md: corrected the runtime assumption. The OpenXR runtime inside Lepton is
  SteamVR (vendor/etc/openxr/1/active_runtime.json -> vrclient.so), not Monado.
  Favourable: SteamVR emulates Oculus Touch by default and advertises the
  XR_FB_foveation family, so the existing input and foveation paths should carry
  over. The old "remaining unknowns" are resolved by Lepton's published source
  and replaced with the items to check before a first Frame boot.
- README.md: same runtime correction.
- docs/research/RECON.md: the four passages prescribing an entitlement
  NOP/stub/bypass are corrected in place rather than merely disclaimed by the
  top banner, which they contradicted.

Build correctness:
- shim/build_android.sh: missing patchelf is now fatal. It warned and exited 0,
  producing a .so that cannot resolve the OpenXR loader at runtime.
- scripts/fetch_deps.sh + packaging/build_openxr_loader.sh: pin the OpenXR and
  Vulkan header versions (were tracking `main`), overridable via OPENXR_TAG /
  VULKAN_HEADERS_TAG; require cmake for the loader build.
- packaging/steamframe_patches.sh: use the apktool.jar that fetch_deps.sh
  downloads. Its prereq check demanded an `apktool` binary on PATH that the
  documented setup never provides, so it could not run after a clean setup.
- shim/gen_stubs.sh: it reads all_exports.txt, not shim_surface.txt; comment and
  emitted banner corrected. stubs.c regenerated (banner line only).
- shim/src/core.c: split seven `if (out) ...; return ...;` one-liners. Host
  build now compiles with zero warnings, down from seven.

Verified: host build 0 warnings; gen_stubs.sh output identical on regeneration;
bash -n clean on all edited scripts; pinned header/tarball URLs return 200 and
the tag tarball extracts to the expected directory name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/research/RECON.md

@@ -10,11 +10,12 @@ Legal posture: dump-your-own only. We extract from hardware *you own* running a
 copy *you own*. **Nothing here gets redistributed** — only patches/shims you
 author, applied by people who dump their own copy. Same model as ReXGlue.
 
-> **Editor's note (2026-06):** this is a historical recon document. It explores an
-> entitlement-**stub** approach in a few places (§4, the wiring summary, the decision tree)
-> that was **not** carried into the project — entitlement handling is out of scope and the
-> shim ships **no circumvention code** (see the README's scope section). Those passages are
-> kept as a record of the original investigation, not as instructions.
+> **Editor's note (2026-06, revised 2026-09):** this is a historical recon document. Its
+> original text proposed an entitlement-stub approach in a few places (§4, the wiring
+> summary, the decision tree). That was **not** carried into the project: entitlement
+> handling is out of scope and the shim ships **no circumvention code** (see the README's
+> scope section). Those passages have since been **corrected in place** so the document no
+> longer reads as instructions; the correction is noted inline where it applies.
 
 ---
 
@@ -98,7 +99,7 @@ Interpret the result:
 |-----------------------------------|-----------------------------------------------------|------------|
 | `libopenxr_loader.so`             | ✅ Standard OpenXR — Steam Frame provides a runtime; you translate vendor extensions. | Tractable |
 | `libvrapi.so`                     | ⚠️ Proprietary Meta VrApi — must reimplement/shim the runtime. | Hard |
-| `libovrplatformloader.so`         | Present either way — this is the **entitlement check** to NOP/stub. | Required patch |
+| `libovrplatformloader.so`         | Present either way — the platform/entitlement library. **Left untouched** by this project (out of scope). | Not patched |
 | `libUE4.so` (or split into modules)| The Unreal runtime itself — the host you'll be hooking. | n/a |
 
 - [x] **RESULT — runtime is:**  ☑ **VrApi** (legacy OVRPlugin path). Confirmed
@@ -117,8 +118,10 @@ libUE4.so --(NEEDED + ovr_* Platform SDK, 132 refs)--> libovrplatformloader.so
 - => **PORT SEAM = reimplement libOVRPlugin.so (ovrp_* on OpenXR), drop libvrapi.**
   ovrp_* is the documented Unity-shared API (OVR_Plugin.h); modern Meta OVRPlugin
   has an OpenXR backend = reference impl / prior art.
-- => **Stub the ovr_* Platform SDK** (libovrplatformloader.so) — entitlement/account,
-  just return OK; don't reimplement.
+- => **Leave the ovr_* Platform SDK alone** (`libovrplatformloader.so`). Entitlement and
+  account handling are **out of scope**: the original library is kept and its real check
+  runs unchanged. (The original recon note here proposed stubbing it; that was *not*
+  carried into the project — see the README's scope section.)
 
 > If you want to double-check beyond filename presence, extract and inspect
 > imports of `libUE4.so` (it may dynamically link the runtime):
@@ -187,12 +190,13 @@ device:             Quest 2 serial <redacted-serial> (codename hollywood)
 
 **Decision tree:**
 - **OpenXR** → next phase: map which Meta OpenXR vendor extensions the binary
-  requests, plan the OpenXR→Steam-Frame-runtime shim + entitlement stub.
+  requests, plan the OpenXR→Steam-Frame-runtime shim.
   This is the "weekend-of-shimming" branch.
 - **VrApi** → next phase: scope a VrApi reimplementation/translation shim
   (much larger). Reassess whether the project is worth it vs. waiting/UEVR.
-- **Either way** → `libovrplatformloader.so` entitlement bypass is a required
-  Ghidra patch (legal for your own copy).
+- **Either way** → `libovrplatformloader.so` is left as shipped. Entitlement handling is
+  out of scope for this project and no bypass is part of it; on Quest the platform's real
+  check runs unchanged. (The original recon note assumed a patch here; superseded.)
 
 ---