docs(re): add reverse-engineering knowledge base + conventions

Establish docs/re/ as the spec-side of the clean-room:
- README: confidence tiers (HYPOTHESIS/PROBABLE/CONFIRMED), promotion
  requires NEW independent evidence, append-only evidence logs,
  demote-on-contradiction, and a clean-room firewall (describe behaviour +
  cite addresses; never paste decompiled code). Documents the toolchain
  (sylpheed.db + zq.py, xenia-rs probes, Wine-Canary oracle) and the
  join-by-guest-PC method with the VA-equality caveat.
- Function/structure templates + a seeded INDEX (9 already-reversed formats).
- First entry: texture-color-k8888 — CONFIRMED plain k_8_8_8_8 is linear
  UNORM (no sRGB), channel order still to be measured.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/re/_TEMPLATE.function.md

@@ -0,0 +1,23 @@
+# `<function name / sub_XXXXXXXX>`
+
+- **Address:** `0x________` (in `sylpheed.db`; `zq.py fn 0x________`)
+- **Confidence:** `HYPOTHESIS | PROBABLE | CONFIRMED`
+- **Reimplemented in:** `crates/…/…rs::fn` — or *not yet*
+- **Related:** other RE entries, `[[memory-slug]]`
+
+## What it does
+One-paragraph behavioural summary, in your own words. No pasted disassembly.
+
+## Signature / calling convention
+Inputs (registers/args + meaning), outputs, side effects (memory it writes, globals, imports it calls).
+
+## Behaviour
+Step-by-step of the observable behaviour — the *spec* to implement from. Formulas, branches,
+state transitions. Cite addresses for detail (`the loop at 0x…`), don't transcribe code.
+
+## Evidence log (append-only; newest last)
+- `YYYY-MM-DD` — *how we know*: static disasm read / `--lr-trace` from 0x… / canary output /
+  N observations. What it established. → confidence set to `…`.
+
+## Open questions / what would raise confidence
+The specific check that would confirm or refute the current claim.