v0.9.0 — cross-platform Prefetch parser

A cross-platform Windows Prefetch parser: SCCA versions 17, 23, 26, 30 and 31,
the SuperFetch Ag*.db family, ReadyBoot traces, Layout.ini, and prefetch
hidden in NTFS alternate data streams. It runs on Linux and macOS as well as
Windows, because the XPRESS Huffman decompressor is written from [MS-XCA]
rather than borrowed from ntdll.

Why 0.9 and not 1.0

The Windows-only code paths have never been executed on Windows. Three
things need a Windows machine and have not had one:

• FindFirstStreamW / FindNextStreamW against a real NTFS volume,
• the bytes RtlDecompressBufferEx returns for a real MAM container (they must
  equal the pure decoder's, byte for byte),
• the frozen .exe under a Windows loader.

Everything above those three calls is exercised on every build against stubs
and forced environments (reference/test_windows_lane.py), including the
ctypes declarations themselves, the \\?\ long-path form, creation-time
semantics and the console encoding. But "tested by proxy" is not "ran", and a
forensic tool should say which one it means. 1.0 follows the first clean run on
Windows.

What is verified

• 23 test suites, all green, against 699 real prefetch files from four
  independent sources and all five format versions.
• 224 expected values taken from a different implementation's own test
  suite — an external oracle, not a second opinion from the same author.
• A suite that cannot run skips rather than passing, and the runner refuses
  to report a skipped run as a pass.
• The frozen bundle's export was compared cell for cell against the source's:
  184 rows × 65 columns, identical.
• Nine rounds of feature-by-feature auditing, 49 defects found and fixed, each
  pinned by a test before moving on.

What is in this release

prefetch-explorer-v0.9.0-linux-x86_64.tar.gz — the CLI (pfcli) and the GUI
(pfgui) as one directory, no Python installation required, Linux x86-64.
Verify it before use:

sha256sum -c SHA256SUMS.txt
tar -xzf prefetch-explorer-v0.9.0-linux-x86_64.tar.gz
./prefetch-explorer/pfcli parse /path/to/Prefetch --db case.db --csv case.csv

For Windows and macOS, run from source (python -m pfcli, python -m pfgui);
the core is pure standard library and the GUI needs PySide6.

The bundle carries the licences of everything it embeds, in
prefetch-explorer/licenses/: this project is MIT, Qt 6 and PySide6 are LGPL-3
and ship as replaceable shared objects.

Known limits, stated plainly

• The Windows lane above.
• ADS recovery needs FindFirstStreamW (Windows) or dissect.ntfs against a
  raw image; on an ext4 copy of a Prefetch folder there is nothing to enumerate,
  and the tool says so rather than reporting "no streams found".
• Reading a folder in place updates its access times. Timestamps are read
  before each file is opened, so SourceAccessed is never this tool's own
  read — but work from a copy anyway.
• A drive letter is inferred by correlation and withheld when the evidence
  cannot support it. It is never read from any file, and a refusal is reported
  rather than silently omitted.

Full documentation: docs/DOCUMENTATION.md.