feat: Phase-2 step2 WriteFieldList verify probe (per-field substitution site)

Hook site = CFlattenedSerializer::WriteFieldList entry (ns 0x343b60, sig in
gamedata) — the per-field loop has both field identity (serializer rdi + changed
-field list param_8) and the dest bf_write (rcx); the generic bit-copy FUN_00500b70
has no field id. Declared all 9 args (6 reg + 3 stack) to avoid the stack-arg
crash. Verify-mode: logs client + serializer + field + changed-count + dst bfw
(first 30). sp_wflprobe / _off. Substitution mechanism (decode/re-encode scratch
or post-write patch) is the next step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>