feat(fifa17): report verified client patch capability

autopatch side of the verified patched-client capability handshake: prove, at
runtime, that the empty-My-Packs resolver guard is active for a specific FIFA
process, and advertise it once on stdout for the launcher to relay.

- Add a per-pid guard verification state derived by a pure, testable
  guard_state_after(cur_before, orig, patch, wrote_ok, cur_after) returning one
  of VERIFIED / UNSUPPORTED_BUILD / WRITE_FAILED / VERIFY_FAILED (NOT_ATTEMPTED
  is the pre-evaluation constant). VERIFIED means the live bytes at RVA 0x14858
  are 7f 0f (JG) after enforcement (from an applied 75 0f->7f 0f, or already
  patched). The existing fail-closed byte guard (guarded_action / STORE_PATCHES_
  GUARDED) is unchanged — this only observes the outcome.
- Emit exactly once per FIFA pid: on VERIFIED,
    [store-guard] verified capability fifa17.empty_mypacks_resolver=1 fifa_pid=<pid>
  otherwise a non-advertising
    [store-guard] guard status=<STATE> fifa_pid=<pid> (no capability advertised)
- Capability constants: EMPTY_MYPACKS_RESOLVER_VERSION=1, fully-qualified name
  "fifa17.empty_mypacks_resolver".
- Tests: 5 guard-state cases + capability-constant assertions (standalone-runnable).

The capability = "the guard was verified in THIS FIFA process", never merely
"the code is present". Design: docs/plans/FIFA17_PATCHED_CLIENT_CAPABILITY.md.

fifa17-recon/tools/test_autopatch_guard.py

@@ -32,7 +32,34 @@ def test_decision():
     assert autopatch.guarded_action(b"\x90", ORIG, PATCH) == "skip"      # wrong length
 
 
+def test_guard_state_after():
+    # already patched (7f0f) -> VERIFIED (guarded_action "noop"); write args irrelevant.
+    assert autopatch.guard_state_after(PATCH, ORIG, PATCH, True, PATCH) == autopatch.GUARD_VERIFIED
+    # original (750f) + write ok + reread 7f0f -> VERIFIED (guarded_action "patch").
+    assert autopatch.guard_state_after(ORIG, ORIG, PATCH, True, PATCH) == autopatch.GUARD_VERIFIED
+    # original + write FAILS -> WRITE_FAILED.
+    assert autopatch.guard_state_after(ORIG, ORIG, PATCH, False, ORIG) == autopatch.GUARD_WRITE_FAILED
+    # original + write ok but reread != 7f0f -> VERIFY_FAILED.
+    assert autopatch.guard_state_after(ORIG, ORIG, PATCH, True, ORIG) == autopatch.GUARD_VERIFY_FAILED
+    assert autopatch.guard_state_after(ORIG, ORIG, PATCH, True, b"") == autopatch.GUARD_VERIFY_FAILED
+    # unknown bytes -> UNSUPPORTED_BUILD (guarded_action "skip"); write args irrelevant.
+    assert autopatch.guard_state_after(b"\x00\x00", ORIG, PATCH, True, PATCH) == autopatch.GUARD_UNSUPPORTED_BUILD
+
+
+def test_capability_constants():
+    assert autopatch.EMPTY_MYPACKS_RESOLVER_VERSION == 1
+    assert autopatch.EMPTY_MYPACKS_RESOLVER_CAPABILITY == "fifa17.empty_mypacks_resolver"
+    # State constant values are the exact tokens carried in the emitted status line.
+    assert autopatch.GUARD_VERIFIED == "VERIFIED"
+    assert autopatch.GUARD_UNSUPPORTED_BUILD == "UNSUPPORTED_BUILD"
+    assert autopatch.GUARD_WRITE_FAILED == "WRITE_FAILED"
+    assert autopatch.GUARD_VERIFY_FAILED == "VERIFY_FAILED"
+    assert autopatch.GUARD_NOT_ATTEMPTED == "NOT_ATTEMPTED"
+
+
 if __name__ == "__main__":
     test_table_exact()
     test_decision()
-    print("OK: autopatch guard table + fail-closed decision (PATCH/NOOP/SKIP)")
+    test_guard_state_after()
+    test_capability_constants()
+    print("OK: autopatch guard table + fail-closed decision + guard-state function + capability constants")