feature: randomize compressor key-derivation moduli (#69)

[mcpolo99]

Level 2 constant randomization — Compressor deriver (#69)

Removes the last fixed magic constants from the compressor packer: the three moduli of the key-derivation generator state = state * state % m, used identically on the obfuscator side (CompressorContext.Encrypt) and in the injected runtime Decrypt. de4dot/AV pattern-match these to fingerprint packed output.

Constant	Role	Was	Now
State modulus	main state advance → src[i]	0x143fc089	curated set → Mutation.KeyI1
Key-word modulus	dst[i] derivation	0x444d56fb	curated set → Mutation.KeyI2
Stream modulus	data-XOR state advance	0x8a5cb7	curated set → Mutation.KeyI3

How sync is preserved

One value per set is chosen per pack, stored on CompressorContext, used by Encrypt for the main module and every embedded library, and injected into the runtime Decrypt via the verified InjectStubKeys helper (the mutation-placeholder + presence-check pattern from the feedback/LCG work). A runtime-source change that drops a placeholder throws ConfuserException instead of silently shipping a stub that can't decrypt. Both Compressor and CompressorCompat runtime variants are handled.

Curated set (scripts/curate_primes.py, seed 69)

The round-trip is correct for any modulus (both sides share it), so the curated values are chosen purely to preserve key-stream quality. Each is:

• prime and ≡ 3 mod 4 — squaring permutes the quadratic residues, so the stream cannot collapse to a fixed point (the original constants were not even prime);
• same bit-length as the original (no (uint) truncation, same value ranges);
• health ≥ original, validated by simulating the exact ulong generator over thousands of random seeds.

32 values per set → ~15 bits of added per-pack identity. The script regenerates the baked CompressorPrimes.cs deterministically and is self-reproducible.

Validation

CompressorWithResx.Test — 12/12 pass (compat true/false × deriver normal/dynamic × resource modes). The test loads a de satellite assembly at runtime, resolved and decrypted through the exact Resolve → Decrypt path these moduli drive; a broken constant-sync fails immediately.

Remaining on #69 (follow-ups)

• XorShift shifts 12/25/27 (Constants) and anti-tamper rotation shifts 5/3/7/11 — need curated valid-triple/quad sets.
• JIT-mode anti-tamper feedback 0x3dbb2819 still hardcoded (Normal/Anti done in feature: randomize anti-tamper feedback + CFG multiplier constants (#69 level 2) #98).
• Level 1 tool-identity script (now planned as .sh).

Part of #69.