like I said, getstatbits.
items = getstatbits(STAT_ITEMS, 0, 23);
items2 = getstatbits(STAT_ITEMS, 23, 9);
if a mod doesn't define items2, then the upper bits contain the runes instead, thus
serverflags = getstatbits(STAT_ITEMS, 28, 4);
of course, it'll reveal only the lower 4 bits, which is sufficient for the 4 runes in quake.
Due to the way it gets munged together, (self.items & (1<<23)) is effectively the same as (self.items2 & 1) at least as far as csqc can tell.
It should be safe enough to just do:
items = getstatbits(STAT_ITEMS, 0, 24);
instead, however, more bits will degrade the fpu precision and give strange results if you pick up a wetsuit.
Note that it is for a reason that mods are not able to munge additional fields together to form unholy monsters like STAT_ITEMS, and thus getstatbits should only be used for STAT_ITEMS.