docs: complete REVERSE_ENGINEERING as the C++ port spec

Reconcile the master RE doc with the verified working implementation and fill
gaps for a core (C++ .Core / C# .Shared) port:

- §6: live encoder fn is slot 0 `*(*(fieldInfo+0x38))`, not `+0x30` (that's the
  registry-entry offset); bucket-3 `default` IS the quantized encoder (no
  "quantized"/"vector3" names). Both were real dev bugs — documented as warnings.
- §9: replace the abandoned cursor-rewind emit (no-ops on the wire) with the
  working redirect-src method (encode fake into a byte-aligned scratch bf_write,
  then call the engine's own BitCopyPrimitive with src redirected).
- §9a: CFieldPath is the struct GetBitRange fills (count@+0x18, flag@+0x1A, index
  shorts, 0x7FFF sentinel) — not a packed token; bounds-checked walk.
- §9b: field-array count@+0x28 bound, record region-id @+0x2C.
- §9d: live value reconstruction for quantized/coord/normal (snapshot+0x30+
  regionId*8 + fieldInfo+0x20).
- §10: full sig↔string-anchor table (the cross-platform find-by-anchor path).
- §10a: ModSharp `refs` (strings/vtables/cvars) — cross-platform + recompile-proof;
  note the gamedata is currently Linux-byte-sig-only with no refs (the work to do).
- §11: complete offset reference (fieldInfo +0x08/+0x20/+0x28/+0x38/+0x40/+0xC9,
  bf_write, CFieldPath, serializer, snapshot, encoder value-ptr conventions) +
  the win/linux calling-convention note.
- §12: implementation map incl. UniformEncoderHook + per-client gating + a port note.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>