Phase 1 architecture solved: game-function resolution via entity vtable slot 0

Breakthrough (no registry RE / hardcoded fn addresses needed): CEntityInstance::
GetNetworkSerializerInfo() is vtable slot 0 -> call it to get the entity's
CNetworkSerializerClassInfo, walk m_Fields (match by m_FieldNameHash), swap the
field's +0x38 encoder ptr. Robust across builds (engine's own vtable), matching how
SourceMod used FindSendPropInfo. Documents the turn-key path + the small offsets left
to confirm via a read-only TTT dump.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>