fix: nested-field resolution via raw CFieldPath (read shorts, not opaque index)

Root cause: GetBitRange's 3rd arg is an opaque registry index, not a packed
CFieldPath — old DecodeToken coincidentally worked top-level only. Now the
GetBitRange hook calls original first (fills the pathOut buffer at arg1) then
captures it; ResolveFieldName reads the path shorts directly (count@hdr+0x18,
ro-flag@hdr+0x1a, idxArr inline-or-indirected, shorts) + walks (stride 0x2e,
child@rec+0x08, child array@child+0x30, leaf name@*(rec+0x00)+0x08). Deleted
DecodeToken. WFLD diag logs ser/count/idx/name (first 25) to verify nested.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>