Add managed list reads

[ero-qt]

Depends on #147.
Part of #149.

Adds get_list_offsets and read_list to both backends' Module, so a List field is two calls instead of hand-derived corlib internals.

• get_list_offsets reads the list object's own class off its header and finds _items and _size in one field scan. The answer is a small Copy value worth storing once, like a field offset: resolution walks class metadata, the read itself doesn't. An object whose class carries different names isn't a list and misses. wait_get_list_offsets for the retry form.
• read_list reads the live count, then exactly that many elements from the backing array. The buffer bounds the count, never the backing's capacity: three elements over an array of two thousand is an ordinary list. A count past the backing's own length is a torn resize and fails, as do null references.
• Element types work like read_array's.

On mono the list class is a generic instance, so the field count resolves through the definition route from #146.