iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

Sources/Catalog4.swift

@@ -54,12 +54,12 @@ extension Catalog {
                 lines.append("EncoderUsage=\(su)  RCMode=\(sr)")
 
                 var accepted: [Int] = []
-                for n in [64, 1024, 16462, 16463] {
+                for n in [0, 1, 7, 8, 64, 1024, 16462, 16463] {
                     let st = aveSet(s, "NumberOfTemporalLayers", NSNumber(value: n))
                     lines.append("NTL \(n): status=\(st)  readback: \(aveRead(s, "NumberOfTemporalLayers"))")
                     if st == 0 { accepted.append(n) }
                 }
-                ctx.disarm("ave.ntl", "accepted=\(accepted.count)/4")
+                ctx.disarm("ave.ntl", "accepted=\(accepted.count)/8")
                 let verdict: String
                 if accepted.contains(16463) {
                     verdict = tl("16463 被接受 —— 该构建的设备在 fire 时会 panic")