Uniform vector spoof: preserve value struct for coord/quantized encoders

Systematic RE of every per-field encoder's valuePtr convention (docs/RE_ENCODERS.md)
found that the b3 struct encoders — quantized (0x3c4d70), coord (0x3cfb40),
coord_integral (0x3d0d20) — read a component count/mode at valuePtr+0x28 and more
than three float lanes. The uniform path wrote only three floats into a non-zeroed
scratch, leaving +0x28 garbage, so those encoders looped a garbage count and
corrupted the delta. (qangle/normal/vector3/pitch_yaw/precise read bare floats and
were fine; the per-client path already copies the live struct.)

Fix: in SharedHook, copy the real value struct (the original valuePtr handed to the
hook, which carries the correct +0x28 and lanes) into the scratch and patch the
leading x/y/z. Correct for the 3-float encoders and non-corrupting for the >3-lane
ones (extra lanes keep their real values). Vector handling moved out of
TryBuildScratch accordingly.

Also documents the full encoder table: float32 reads a double (not float — already
correct), string is char**, byte-array is {data,+0x28 count}, all int/uint/bool
verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>