Harden CI digest parsing and failure cleanup

tests/README.md

@@ -0,0 +1,23 @@
+# Code Integrity regression tests
+
+From an **x64 Visual Studio developer shell**, with the Windows SDK and Python 3:
+
+```powershell
+python tests\run-digest-tests.py
+```
+
+The runner extracts the production digest, pattern-search, algorithm-mapping,
+and legacy-validation functions without changing their bodies. The C++ harness
+uses real user-mode BCrypt hashing and test doubles for pool allocation, file
+reads, and CI. No driver is installed or loaded. Build outputs are temporary.
+
+Coverage includes PE32/PE32+ digest fixtures, checksum and certificate exclusions,
+a DOS stub larger than 4 MiB, truncated headers next to inaccessible guard pages,
+invalid offsets and lengths, absent security-directory entries, injected hashing
+and allocation failures, deterministic failure outputs, allocation ownership,
+and rejection of successful-but-short certificate reads before invoking CI.
+
+The tests do not validate CI trust policy, asynchronous kernel I/O behavior, or
+general Authenticode hashing of unusual section layouts. The digest implementation
+still uses its existing linear byte-order convention and heuristic signature
+algorithm detection; replacing those requires a separate compatibility corpus.