Safe binary patching for r2SMT.
Phase 10 closes the loop from solver verdict → committed binary
change. Every applied patch is recorded in a [PatchManifest] and
a full-file backup is taken before any byte is written, so the
pipeline can roll back to a known-good state even if the host
process is killed mid-flight.
The crate is sample-agnostic: it never inspects sample-specific
values or branches on opcode signatures from a single family.
Strategies are defined in terms of the abstract finding kinds
produced by r2smt-core.