fix(re): correct EncodeField to verified entry 0x3334e0

Previous 0x3356dd was a Ghidra image-base-offset that landed mid-instruction
(would crash if armed). Walked back from the 'EncodeField encoder wrote %d bits'
string xref (0x3357fb) to the owning function prologue at file-vaddr 0x3334e0:
sub $0x2c8,%rsp + mov %r9,-0x290(%rbp) matches the xref's frame slot. Signature
is unique in the binary. Documents the full re-derivation recipe (RE doc §8).

Still a candidate for the per-tick value hook pending dynamic gdb confirmation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>