RXRE engine v1.6.0 — discovery module + critical latent bug fix

RXRE engine v1.6.0 — P0 (discovery) partial + critical latent bug fix (2026-11-13).

What changed under the hood:

• tools/rxre/semantic/discovery.py (new): discover_unknown_function(binary_path) — picks largest FUNCTION_CANDIDATE from the reconstructor, enumerates rivals from literals in rodata (prefix/exact/first-byte), marks _no_profile_imported = True. Lab tests: test_discovery_unknown.py — 2 tests, both PASS.
• Critical latent bug fixed in reconstructor.py: the CFG pump never produced any CFG (_json was never aliased before use, subprocess was missing at module scope, re similarly) — every analyzed binary decayed to ANALYSIS_FAILED. With it fixed, FUNCTION_CANDIDATE count balloons as expected.
• verify.sh: 15 stages, expected pins 74 passed / 2 skipped.

Epistemic status: P0 remains largely OPEN. Discovery produces rival hypotheses from the visible rodata, but semantic hypotheses have NOT been driven to a verified reconstruction of an unknown function. reconstruct() remains a structural scaffold; _discovery itself does NOT produce byte-exact reconstruction yet. Third-party verification NOT_EXECUTED. MIT.

ZIP SHA-256: see rxre-engine-1.6.0.zip.sha256.