v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

Sources/Runners.swift

@@ -317,13 +317,20 @@ enum Runners {
                                   bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue) else {
             throw LabError(message: tl("上下文创建失败"))
         }
-        // drawing forces the charstring interpreter to run
-        for g in 1..<min(Int(glyphCount), 8) {
-            var glyph = CGGlyph(g)
-            var position = CGPoint(x: 20, y: CGFloat(40 * (g + 1)))
-            CTFontDrawGlyphs(ctFont, &glyph, &position, 1, ctx)
+        // drawing forces the charstring interpreter to run.
+        // glyphCount == 0 is a real malformed-font shape (the POCs feed exactly those),
+        // and `1..<0` would trap — guard the range instead of assuming the count.
+        let upper = min(Int(glyphCount), 8)
+        var drawn = 0
+        if upper > 1 {
+            for g in 1..<upper {
+                var glyph = CGGlyph(g)
+                var position = CGPoint(x: 20, y: CGFloat(40 * (g + 1)))
+                CTFontDrawGlyphs(ctFont, &glyph, &position, 1, ctx)
+                drawn += 1
+            }
         }
-        return tl("字体加载成功 name=") + "\(name)" + tl(" glyphs=") + "\(glyphCount)" + tl("，已绘制 ") + "\(min(Int(glyphCount), 8) - 1)" + tl(" 个字形")
+        return tl("字体加载成功 name=") + "\(name)" + tl(" glyphs=") + "\(glyphCount)" + tl("，已绘制 ") + "\(drawn)" + tl(" 个字形")
     }
 
     // ---- Model I/O (libusd_ms)