v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112522/CVE-2026-112522.py

@@ -1,21 +1,4 @@
 #!/usr/bin/env python3
-# arc.iso · libarchive · build_pathname_utf16be · CVE-2026-112522
-# 原语: OOB 写 · 进程内 | Primitive: OOB write · in-process
-#
-# [zh] ISO9660 Joliet 路径名堆溢出
-# build_pathname_utf16be 在递归拼入父路径之后无条件写入 2 字节的 UTF-16BE '/'，且不再复核累计长度是否超过 1024 的上限。当目录链累计长度恰为
-# 1024 字节时，最深层回卷的写入落在 p[1024] 与 p[1025]，越过 malloc(1024) 两个字节，其中 0x002F 覆盖相邻堆块头。
-#
-# [en] ISO9660 Joliet pathname heap overflow
-# After recursively appending the parent path, build_pathname_utf16be unconditionally writes
-# a 2-byte UTF-16BE '/' without re-checking the running length against the 1024 limit. When
-# a directory chain sums to exactly 1024 bytes the deepest unwind writes at p[1024] and p[1025],
-# two bytes past a malloc(1024) buffer, and 0x002F overwrites the adjacent heap chunk header.
-#
-# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
-# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112522.swift
-# triggers (run closures) & non-seed builders: CVE-2026-112522.swift in this folder
-
 import struct
 
 SECTOR = 2048