Segment ONE code unit at offset (no allocation of the whole list). Returns (cid, byteCount) or null at/after EOF. Used on the hot advance path so we don't re-scan the tail of the byte string per glyph.