Document verified CFlattenedSerializer layout (name/count/field-array offsets)

From RE of CFlattenedSerializer::WriteFieldList: serializer name @+0x00, field count
@+0x08, field-array (array of pointers to field records, stride 8) @+0x10; field record
vtable @+0x00, name via sub-object @+0x10 (inferred). Documents the remaining unknowns
before the live patch is safe: the class->serializer registry lookup, confirming the
field-array record is EncodeField's fieldInfo (so +0x38 applies), and the name offset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>