Correct EncodeField entry (0x4334d0, not 0x4334e0) + verified byte-sig runtime resolve

Ghidra's FUN_004334e0 entry was 0x10 bytes into the function (mid-instruction) — a detour
there would SIGSEGV. True entry 0x4334d0 (push rbp; mov rbp,rsp; push r15..r12; push rbx;
sub 8). Extracted a unique signature (distinctive via the and ebx,0x7fffffff hash mask) and
wired FindPattern resolution — VERIFIED it resolves live on TTT to a sane address. Note: the
earlier decomp's 5-arg signature came from the wrong (mid-function) entry and is unreliable;
the true signature must be re-derived from 0x4334d0 before installing a detour.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>