iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

tools/ipsw/README.md

@@ -0,0 +1,16 @@
+# IPSW kernel-diff toolkit
+
+Read-only helpers used for the 27.0.1 → 27.2 kernel comparison in
+[`docs/IOS27.2-KERNEL-DIFF.md`](../../docs/IOS27.2-KERNEL-DIFF.md).
+
+| Script | Purpose |
+|---|---|
+| `remote_ipsw.py` | HTTP-Range ZIP reader: list/extract a member without downloading the whole IPSW |
+| `ipswlib.py` | IM4P/LZFSE decode, Mach-O/fileset parse, cstring extraction |
+| `extract_kext.py` | dump one fileset entry as a standalone Mach-O (linkedit offsets rebased) |
+| `disasm_diff.py` | normalized `llvm-objdump` instruction diff for two kexts |
+| `diff_kernel.py` | kext-level diff (bundle id, size, strings, function hashes) |
+| `map_advisory.py` | advisory CVE list → component/binary candidate table |
+
+Requirements: Python 3, `pip install lzfse macholib`, Xcode command line tools
+(`llvm-objdump`). Nothing writes to a device.