Annotation subject split/self-key JavaScript stager

This family uses syncAnnotScan()/getAnnots() only as a staging primitive. The visible OpenAction reads an annotation /Subject value, splits marker-prefixed hex bytes into a second-stage decoder, and that decoder reads another annotation subject and decrypts two-character pairs with a digit key before evaling the recovered JavaScript. The rule is emitted only after static decoding recovers exploit-like Acrobat JavaScript; CVE attribution comes from the vulnerable API in the recovered stage.