v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

Sources/Tools.swift

@@ -174,10 +174,7 @@ enum Identity {
         rows.append((tl("主机名"), sysctlString("kern.hostname") ?? "—"))
         rows.append((tl("启动 UUID"), sysctlString("kern.bootsessionuuid") ?? "—"))
         rows.append((tl("启动时间"), sysctlString("kern.boottime") ?? "—"))
-        if let model = sysctlString("hw.machine") {
-            rows.append((tl("市场名称"), DeviceModel.current().marketingName))
-            _ = model
-        }
+        rows.append((tl("市场名称"), DeviceModel.current().marketingName))
         rows.append((tl("广告标识符"), ASIdentifierSummary.current))
         return rows
     }
@@ -359,6 +356,9 @@ struct MachOInfo {
 enum MachOInspector {
     static func inspect(_ path: String) -> MachOInfo? {
         guard let data = try? Data(contentsOf: URL(fileURLWithPath: path)) else { return nil }
+        // a Mach-O header needs at least the magic; anything shorter is not one. The
+        // load below would read past the buffer (or hit a nil base on empty Data).
+        guard data.count >= 4 else { return nil }
         var info = MachOInfo()
 
         let magic = data.withUnsafeBytes { $0.load(as: UInt32.self) }