1. Without this save glitch, roughly how long does the game take to complete?
2. How did you discover that the game's officers were being stored in a linked list, and how did you find where the linked list was in memory?
1. Not entirely sure, hopefully sub-20 minutes. Your AI commanders can request to attack cities on their own which lets you capture cities without having to view battle sequences. You can manipulate RNG to capture (almost) all of the enemies' officers each battle. You can also bait the enemy into attacking your city only for them to lose & get all their officers captured. England's sea control makes it hard to go after them but you can start decimating their ship count by baiting them into attacking an unoccupied coastal city & then recapturing it.
To further weaken the enemy you can manipulate national actions so that nations go to war with each other & whittle down each others' forces in the process, or random events like the plague to hit a bunch of enemy cities.
I might try it at some point but clearly it takes a lot of planning & manipulation.
2. Pretty sure I started off just using RAM search to detect changes I made to a specific officer's stats & then slowly intuited the meaning of the entire array from that.
btw, the NES Koei games (& some of their SNES games) all appear to have been compiled from C source code to a custom bytecode interpreted by a virtual machine: https://forums.nesdev.com/viewtopic.php?f=2&t=15931
There are also games functions that are in 6502 but I'm pretty sure were also directly compiled from C based on their formatting.
The text strings are formatted like C-strings and the games contain functions from the C standard library, including the random number generator.