feat(v2.5.0): upgrade to four-axe JSVMP methodology + MCP v0.4.0 alignment

- Add fourth axe: source-level instrumentation via instrument_jsvmp_source
- Add new reference: references/jsvmp-source-instrumentation.md
- Align MCP tool count 52 -> 65 across SKILL.md / README.md / mcp-cookbook.md
- New scenario 11: universal JSVMP source instrumentation (Rui Shu / Akamai / webmssdk)
- Enhance scenario 2 with analyze_cookie_sources for cookie attribution
- Extend experience rules from 22 to 27
- New case skeleton: cases/universal-vmp-source-instrumentation.md
- New case: cases/jsvmp-ruishu6-cookie-412-sdenv.md
- Update jsvmp-analysis.md from three-axe to four-axe methodology
- Document new presets 'cookie' and 'runtime_probe'
- Document pre_inject_hooks / via_blank / reload_with_hooks for first-screen challenges
- Add troubleshooting section for 412/403 first-screen challenges

references/troubleshooting.md

@@ -226,3 +226,8 @@
 | 验证环境检测 | `get_fingerprint_info` + `check_detection` | 确认哪些环境项参与校验 |
 | 追踪调用链 | `get_request_initiator` | 从请求直接定位到签名函数 |
 | 实时对比 | `evaluate_js` | 在浏览器中执行还原后的签名函数，与脚本输出对比 |
+| **Cookie 归因** [v2.5.0] | `analyze_cookie_sources` | 辨识 Cookie 是 HTTP Set-Cookie 还是 JS document.cookie 写的 |
+| **源码级插桩** [v2.5.0] | `instrument_jsvmp_source` + `get_instrumentation_log` | 对 VMP 做 HTTP 层源码改写，hot_keys 暴露环境指纹集 |
+| **首屏挑战** [v2.5.0] | `navigate(pre_inject_hooks=[...])` | 瑞数/Akamai 412 挑战页 hook 预注入 |
+| **hook 重载** [v2.5.0] | `reload_with_hooks` | 重载使 persistent hook 先于页面 JS 执行 + 清日志 |
+| **运行时探针** [v2.5.0] | `get_runtime_probe_log` | 快速摸底页面在读什么 / 调什么（低开销） |