v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

Sources/ModTools.swift

@@ -246,9 +246,11 @@ enum MachO {
         }
         guard removed > 0 else { return (data, 0) }
 
-        // rewrite the command stream in place, then zero the tail of the old region
+        // rewrite the command stream in place, then zero the tail of the old region.
+        // sizeofcmds is attacker-controlled in a malformed header — clamp before indexing,
+        // or the zeroing loop below walks off the end of the image.
         let streamStart = h.headerSize
-        let oldEnd = streamStart + Int(h.sizeofcmds)
+        let oldEnd = min(streamStart + Int(h.sizeofcmds), out.count)
         out.replaceSubrange(streamStart..<(streamStart + kept.count), with: kept)
         if streamStart + kept.count < oldEnd {
             for i in (streamStart + kept.count)..<oldEnd { out[i] = 0 }