Uniform hook: fix dangling stackalloc for string/byte-array spoofs

The string and byte-array cases in TryBuildScratch allocated their payload
buffer with stackalloc inside that method, stored the pointer into the value
slot, and returned — freeing the buffer's stack frame. SharedHook then called
the engine encoder, which dereferences the value pointer (b5 string does
WriteString(bf, *valuePtr); b6 reads {data,+0x28 count}); by then the buffer
was reclaimed and overwritten by the call frame, so the encoder serialized
garbage — fake names showed as weird symbols.

Move the string/byte-array payload allocation into SharedHook's own frame so
it stays alive across the encoder Invoke. Scalars are unaffected (written
directly into the caller-owned scratch) and the per-client FieldSubstitution
path already builds inline in one method.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>