Implement RemoteModule/RemoteFunction and prove x64 ABI at runtime

Task 7.2: export resolution + module/function facade.
- PeHeaderParser.GetExportAddress walks the PE32/PE32+ export directory and
  follows export forwarders (e.g. kernel32!HeapAlloc -> NTDLL.RtlAllocateHeap)
  into other loaded modules; ordinal and unresolvable API-set forwarders throw
  NotSupportedException.
- RemoteModule resolves a module base via Process.Modules (name match tolerant
  of .dll/case); RemoteFunction executes via RemoteThreadExecutor by default,
  exposes Address for pump routing and CreateDelegate<T> for in-process.
- Magic gains a string indexer: magic["user32"]["MessageBoxA"].

Task 3.8: add the missing live-execution ABI test - an SSE callee whose aligned
movaps #GPs unless the stub delivers a 16-byte-aligned stack, combined with a
5th stack argument. Runtime-proves shadow space, alignment, and arg placement.

Tests: 214 passing, 4 skipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

WhiteMagicTest/ModuleFunctionTests.cs

@@ -0,0 +1,95 @@
+using System;
+using System.Diagnostics;
+using WhiteMagic;
+using WhiteMagic.Assembly;
+using WhiteMagic.Native;
+using Xunit;
+
+namespace WhiteMagicTest;
+
+/// <summary>
+/// Tests for <see cref="RemoteModule"/> / <see cref="RemoteFunction"/> resolution and
+/// execution through the <see cref="Magic"/> facade (task 7.2).
+/// </summary>
+public class ModuleFunctionTests
+{
+    // Ensure a module is loaded in this process before resolving it.
+    private static IntPtr Load(string module)
+    {
+        IntPtr handle = NativeMethods.LoadLibrary(module);
+        Assert.NotEqual(IntPtr.Zero, handle);
+        return handle;
+    }
+
+    [Fact]
+    public void Module_indexer_resolves_base_address()
+    {
+        IntPtr handle = Load("kernel32.dll");
+
+        using var magic = Magic.OpenInProcess();
+        RemoteModule module = magic["kernel32"];
+
+        // The module handle returned by LoadLibrary is the module's base address.
+        Assert.Equal(handle, module.BaseAddress);
+        Assert.Equal("KERNEL32.DLL", module.Name, ignoreCase: true);
+    }
+
+    [Fact]
+    public void Function_indexer_resolves_direct_export()
+    {
+        IntPtr handle = Load("user32.dll");
+        IntPtr expected = NativeMethods.GetProcAddress(handle, "MessageBoxA");
+        Assert.NotEqual(IntPtr.Zero, expected);
+
+        using var magic = Magic.OpenInProcess();
+        RemoteFunction fn = magic["user32"]["MessageBoxA"];
+
+        Assert.Equal(expected, fn.Address);
+        Assert.Equal("MessageBoxA", fn.Name);
+    }
+
+    [Fact]
+    public void Function_indexer_follows_export_forwarder()
+    {
+        // kernel32!HeapAlloc is a classic forwarder to NTDLL.RtlAllocateHeap. Whatever the
+        // OS loader resolves it to, our parser must reach the same final address.
+        IntPtr handle = Load("kernel32.dll");
+        IntPtr expected = NativeMethods.GetProcAddress(handle, "HeapAlloc");
+        Assert.NotEqual(IntPtr.Zero, expected);
+
+        using var magic = Magic.OpenInProcess();
+        RemoteFunction fn = magic["kernel32"]["HeapAlloc"];
+
+        Assert.Equal(expected, fn.Address);
+    }
+
+    [Fact]
+    public void Module_indexer_throws_for_unloaded_module()
+    {
+        using var magic = Magic.OpenInProcess();
+        Assert.Throws<DllNotFoundException>(() => magic["definitely-not-loaded-xyz.dll"]);
+    }
+
+    [Fact]
+    public void Function_indexer_throws_for_unknown_export()
+    {
+        Load("kernel32.dll");
+
+        using var magic = Magic.OpenInProcess();
+        Assert.Throws<InvalidOperationException>(() => magic["kernel32"]["NoSuchExport_ZZZ"]);
+    }
+
+    [Fact]
+    public void Resolved_function_executes_via_remote_thread()
+    {
+        Load("kernel32.dll");
+
+        using var magic = Magic.OpenInProcess();
+        RemoteFunction getPid = magic["kernel32"]["GetCurrentProcessId"];
+
+        // GetCurrentProcessId takes no args and is thread-agnostic; a remote thread in our
+        // own process must report our PID.
+        uint pid = getPid.Execute<uint>(CallConvention.Stdcall);
+        Assert.Equal((uint)Process.GetCurrentProcess().Id, pid);
+    }
+}