Annotation subject callee-key hex JavaScript stager

Agent-359xx/361xx style PDFs use syncAnnotScan()/getAnnots() only as a staging primitive: JavaScript reads an indirect annotation /Subject stream, rewrites marker bytes such as F/A/E or z to percent signs, or splits short delimiter-prefixed hex bytes such as mz/xyz. The recovered second-stage decoder then derives a small key from arguments.callee.toString() or an embedded numeric table to decode the final exploit JavaScript. The rule is emitted only after static decoding recovers exploit-like JavaScript; the exact CVE is then assigned by scanning the recovered stage for the real vulnerable API.