README: add output format docs for --subs-only and --clean modes

- Add mode field to normal JSON output example
- Add --subs-only output section with JSON sample
- Add --clean output section with stack_offset and xrefs sample
- Add --subs-only --clean combined output section
- Update function count 422 -> 414 (empty function removal)
- Include test example files for all modes

README.md

@@ -133,7 +133,7 @@ imports: 85
   0x140020290 HeapSize (KERNEL32.dll)
   0x140020298 CreateFileW (KERNEL32.dll)
   0x1400202a0 RtlUnwind (KERNEL32.dll)
-functions: 422
+functions: 414
 indirect targets: 1372
 cfg written to: tests\example1.exe.cfg
 ```
@@ -145,6 +145,7 @@ The `.cfg` file is structured JSON. Here's what it looks like:
 ```
 {
   "binary": "tests\\example1.exe",
+  "mode": "full",
   "arch": "x86-64",
   "format": "PE",
   "entry_point": "0x1400054bc",
@@ -383,6 +384,123 @@ The `.cfg` file is structured JSON. Here's what it looks like:
         ...
 ```
 
+### `--subs-only` output
+
+```
+{
+  "binary": "C:\\binaries\\target.exe",
+  "mode": "subs-only",
+  "arch": "x86-64",
+  "format": "PE",
+  "entry_point": "0x1400054bc",
+  "imports": [ ... ],
+  "indirect_targets": [ ... ],
+  "functions": [
+    {
+      "address": "0x1400054bc",
+      "name": "entry",
+      "blocks": [ ... ]
+    },
+    ...
+  ]
+}
+```
+
+The `"mode": "subs-only"` field tells downstream tools this CFG only contains functions reachable from the entry point. Unreachable exports and prolog candidates are excluded — fewer functions, cleaner analysis surface.
+
+### `--clean` output
+
+```
+{
+  "binary": "C:\\binaries\\target.exe",
+  "mode": "full+clean",
+  "arch": "x86-64",
+  "format": "PE",
+  "entry_point": "0x1400054bc",
+  "imports": [ ... ],
+  "indirect_targets": [ ... ],
+  "functions": [
+    {
+      "address": "0x1400054bc",
+      "name": "entry",
+      "blocks": [
+        {
+          "address": "0x1400054bc",
+          "size": 4,
+          "is_prolog": false,
+          "is_epilog": false,
+          "instructions": [
+            {
+              "address": "0x1400054bc",
+              "size": 4,
+              "mnemonic": "sub",
+              "operands": "rsp, 0x28",
+              "stack_offset": 0
+            },
+            {
+              "address": "0x1400054c0",
+              "size": 5,
+              "mnemonic": "call",
+              "operands": "0x140005d30",
+              "stack_offset": -40
+            },
+            {
+              "address": "0x1400054c5",
+              "size": 4,
+              "mnemonic": "add",
+              "operands": "rsp, 0x28",
+              "stack_offset": -40
+            },
+            {
+              "address": "0x1400054c9",
+              "size": 5,
+              "mnemonic": "jmp",
+              "operands": "0x140005340",
+              "stack_offset": 0
+            }
+          ],
+          "successors": [ "0x140005340" ]
+        },
+        ...
+      ]
+    },
+    ...
+  ],
+  "xrefs": [
+    {
+      "target": "0x140011b00",
+      "callers": [
+        { "address": "0x14001a30f", "type": "call" },
+        { "address": "0x140019ec1", "type": "call" },
+        ...
+      ]
+    },
+    {
+      "target": "0x140007394",
+      "callers": [
+        { "address": "0x14001a31a", "type": "call" },
+        ...
+      ]
+    },
+    ...
+  ]
+}
+```
+
+Every instruction in `--clean` mode includes `stack_offset` — the RSP delta from function entry at that instruction point. The `xrefs` section maps each call/jump target back to every instruction that references it.
+
+### `--subs-only --clean` combined output
+
+```
+{
+  "binary": "C:\\binaries\\target.exe",
+  "mode": "subs-only+clean",
+  ...
+}
+```
+
+Same structure as `--clean`, but with `"mode": "subs-only+clean"` to indicate both filters were applied. Function count is reduced to only entry-point-reachable functions, and remaining functions have stack offsets and xrefs.
+
 ## building
 
 Requires CMake and a C++17 compiler. Capstone is fetched automatically.