v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112611/CVE-2026-112611.swift

@@ -1,30 +1,7 @@
 // cg.shading · CoreGraphics · _cg_shading_type5_draw · CVE-2026-112611
-// 原语: OOB 写 · 进程内 · tier 1
-// Primitive: OOB write · in-process · tier 1
-//
-// [zh] Type-5 阴影栈溢出（值可控 OOB 写）
-// /ShadingType 5 的 /Function 声明的 /Range 维度与 /ColorSpace 的分量数不一致。绘制时 _cg_shading_type5_draw 为每个三角形顶点构造一条
-// 72 字节网格记录，颜色区位于记录 +0x20、容量为 nc×8 字节，随后调用 CGFunctionEvaluate —— 该函数以其自身 [func+0x30] 字段（即 /Range
-// 维度）为上界，向该颜色区写入 range 个 double。写入长度与目标容量之间没有任何比较。网格数组由 CGTriangleMeshCreate 在栈上 alloca，故最后一条记录的写会依次越过记录尾、辅助数组、行缓冲与保存寄存器。
-//
-// [en] Type-5 shading stack overflow (value-controlled OOB write)
-// A /ShadingType 5 dictionary whose /Function declares a /Range dimension that does not match the
-// component count of its /ColorSpace. At draw time _cg_shading_type5_draw builds one 72-byte mesh
-// record per triangle vertex — the colour area sits at record +0x20 with capacity nc×8 bytes — then
-// calls CGFunctionEvaluate, which bounds its write by its own [func+0x30] field (the /Range dimension)
-// and writes that many doubles into the colour area. No comparison exists between the write length
-// and the destination capacity. The mesh array is alloca'd on the stack by CGTriangleMeshCreate,
-// so the last record's write walks past the record tail, the auxiliary arrays, the row buffers and
-// the saved registers in order.
-// ── 判别 / oracle ──
-// 取 R=136、nc=1、/C0=/C1=1.0 时，每次写入的 double 位模式均为 0x3FF0000000000000。溢出同时覆盖溢出的三角形计数与网格指针两个 spill 槽；
-// 循环退出比较读到被覆盖后的计数后继续执行，随后解引用被覆盖的网格指针。因此崩溃地址即 PDF 选定的 double 位模式加一个结构偏移 —— 设备实测 0x3ff000000000001c，
-// 其中 0x1c = idx×16 + 0xc。27.2 在解析期以 CG-SEC-187882049 拒绝该字典，draw 代码两侧字节完全一致，属纯闸门修复。
-//  变体 cg.shading.sweep: 溢出长度扫描（找吸收阈值）
-
 import Foundation
 
-// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
+// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
 enum B {
     static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
     static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
@@ -45,22 +22,8 @@ enum B {
     static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
 }
 
-/*
-// cg.shading.sweep · CoreGraphics · Type-5 shading · CVE-2026-112611
-// 原语: OOB 写 · 进程内 · tier 1
-// Primitive: OOB write · in-process · tier 1
-//
-// [zh] 溢出长度扫描（找吸收阈值）
-// 短溢出会被相邻 VLA 吸收而不触发故障 —— 写入必须足够长才能触及活状态。本轮将 R 由 4 递增至 256，逐一记录是否仍能完成渲染，从而标定该构建上栈布局的实际边界。该阈值决定后续所有负载的长度预算。
-//
-// [en] Overflow length sweep (finding the absorption threshold)
-// A short overflow is absorbed by the adjacent VLA without faulting — the write has to be long enough
-// to reach live state. This pass steps R from 4 to 256, recording at each value whether rendering
-// still completes, and thereby maps the real boundary of the stack layout on this build. That threshold
-// sets the length budget for every subsequent payload.
-*/
 
-// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (PDFPayload) ──
+// ── seed construction (from Cinder27 Sources: PDFPayload) ──
 enum PDFPayload {
 struct BitWriter {
     private(set) var out: [UInt8] = []