Phase 2 per-client value substitution working (verify-confirmed) + docs

- FieldSubstitution: removed VCOPY diagnostic flood; kept substitution +
  throttled SUBST-VERIFY/SUBST-FAKE logs. Mechanism verified end-to-end on TTT
  (m_iHealth resolves, recipient captured, cursor math correct, no corruption).
- README: rewritten for Phase1 (uniform, live) + Phase2 (per-client, verified);
  command list, build/deploy + gamedata-nesting gotcha, known limits (int32 only,
  top-level fields, nested-path descent TODO).
- docs/REVERSE_ENGINEERING.md §15: full Phase-2 send path + substitution mechanism
  (CFieldPath token, flattened-serializer field-array layout, the per-field copy
  hook + varint write).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>