analyzer+codegen: lift the 4-param ceiling via a direct-write calling convention

Follow-up to the silent-drop audit. The old ABI passed every
parameter through four fixed zero-page transport slots `$04-$07`,
imposing a hard 4-param cap (E0506) that didn't compose with
structs/arrays/u16s and fell back to "pack args into a global"
workarounds whenever a function needed five things. The transport
scheme also cost every non-leaf call a 4-LDA/STA spill prologue
(~28 cycles, 16 bytes) to copy args out of ZP before the next
nested `JSR` could clobber them.

Replace it with a hybrid convention keyed on leaf-ness:

- **Leaf callees** (no nested `JSR` in body, ≤4 params):
  unchanged. Caller stages args into `$04-$07`; body reads those
  slots directly for its entire lifetime. No prologue copy.
  Fastest path, 3-cycle ZP stores + 3-cycle ZP loads, preserves
  the SHA-256 leaf-primitive optimisation that motivated the
  original fast path.

- **Non-leaf callees** (body contains a nested `JSR`, OR ≥5
  params): direct-write. Caller stages each argument straight
  into the callee's analyzer-allocated parameter RAM slot,
  bypassing the transport slots entirely. No prologue copy on
  the callee side. Saves ~24 cycles and ~16 bytes per call vs
  the old transport-then-spill path, and — crucially — scales
  past 4 params because the per-param slots live wherever the
  analyzer put them rather than in a fixed ZP window.

The analyzer's ceiling moves from 4 to 8. Functions with 5–8
params are silently promoted to the non-leaf convention (even if
their body has no nested `JSR`), which pays the direct-write cost
rather than the prologue-copy cost — still cheaper than the old
ABI. Declarations with 9+ params still emit E0506.

### Implementation

- `function_is_leaf` now also requires `param_count <= 4`.
- `IrCodeGen::new` populates `non_leaf_param_addrs: HashMap<String,
  Vec<u16>>` — for every non-leaf function, the ordered list of
  addresses its parameters occupy. Callers use this to route each
  arg directly to the right slot.
- `IrOp::Call` branches on presence in the map: non-leaf → direct-
  write, leaf (or absent — 0-arg case) → ZP transport.
- `gen_function` no longer emits a prologue. Leaves didn't have
  one; non-leaves had a 4-LDA/STA copy that is now unnecessary
  because args arrive pre-written to the slot.
- The previous `leaf_functions: HashSet<String>` field is
  removed; leaf-ness is now inferred from absence-in-
  `non_leaf_param_addrs` at the call site.

### Tests and regressions

- `eight_param_non_leaf_function_stages_every_arg_at_its_allocated_slot`
  compiles an 8-param function, scans PRG for a distinct
  `LDA #\$NN / STA <addr>` per arg (immediates `0x11..0x88`), and
  asserts that STAs to the `$04-$07` range are strictly fewer
  than 8 — proof the old transport path is gone for this call.
- `non_leaf_call_direct_writes_args_to_callee_param_slots`
  replaces the old `gen_function_prologue_spills_params_to_local_ram`
  test with a dual assertion: (a) no `LDA \$04` prologue at the
  callee entry, and (b) the caller-side STA lands at the
  analyzer-allocated param slot, not at `\$04-\$07`.
- `analyze_rejects_function_with_more_than_4_params` renamed and
  rewritten for the new 8-param cap.
- `feature_canary.ne` gains a 6-param `sum6` call (1+2+3+4+5+6 =
  21) as check 8. The canary stays green (all eight checks
  pass), so the committed golden is unchanged.

### Blast radius

- Six example ROMs change bytes (arrays_and_functions, function_chain,
  mmc1_banked, pong, sha256, war) because their non-leaf call sites
  pick up the shorter staging sequence.
- Pong and war audio hashes refresh (pure layout-timing shift; no
  behavioural change in the 180-frame no-input window). docs/pong.gif
  and docs/war.gif stay byte-identical.
- `examples/function_chain.ne`'s header comment updated to
  document the leaf vs non-leaf split it exercises.
- `docs/language-guide.md` parameter-count section and E0506 entry
  updated to reflect the new rule.

All 720 Rust tests pass; all 35 emulator goldens pass.

https://claude.ai/code/session_01AoQ678uVeqpyayvWHpfDhC

examples/feature_canary.ne

@@ -80,6 +80,22 @@ fun double_u8(x: u8) -> u8 {
     return x + x
 }
 
+// A six-parameter non-leaf function. The call site exercises
+// the direct-write calling convention — the caller stages each
+// arg straight into the callee's per-param RAM slot, no
+// transport through `$04-$07`. Returns the sum of all six, so
+// a regression that silently drops any one (same shape as PR
+// #31 but for params) knocks the result off 21 and flips the
+// canary red.
+fun sum6(a: u8, b: u8, c: u8, d: u8, e: u8, f: u8) -> u8 {
+    var tmp: u8 = a + b
+    tmp = tmp + c
+    tmp = tmp + d
+    tmp = tmp + e
+    tmp = tmp + f
+    return tmp
+}
+
 // ── Main state ─────────────────────────────────────────────
 
 state Main {
@@ -128,6 +144,12 @@ state Main {
         var r: u8 = double_u8(21)
         if r != 42 { all_ok = 0 }
 
+        // Check 8: six-parameter non-leaf function — exercises
+        // the direct-write calling convention that lifts the
+        // old 4-param ceiling. 1+2+3+4+5+6 = 21.
+        var s: u8 = sum6(1, 2, 3, 4, 5, 6)
+        if s != 21 { all_ok = 0 }
+
         // Drive the backdrop flip. `set_palette` schedules an
         // update during the next vblank, so the effect lands on
         // the following frame — well before the frame-180 golden

examples/function_chain.ne

@@ -6,14 +6,24 @@
 //
 //   frame -> compute -> scale -> clamp -> fold -> taper
 //
-// Each function takes its argument through the zero-page
-// parameter slots ($04-$07), computes a small transform, and
-// returns a value in A. The chained result is what drives the
-// player sprite's X position on screen each frame.
+// Each function takes its argument through the calling
+// convention and returns a value in A. The chained result is
+// what drives the player sprite's X position on screen each
+// frame.
+//
+// Parameters land at a non-uniform address set:
+//   - The deepest callee (`taper`) is a leaf — it has no nested
+//     `JSR` and can receive its arg in the `$04` transport slot
+//     directly. Its body reads `$04` in place of a spill copy.
+//   - Every other function (`compute`, `scale`, `clamp`, `fold`)
+//     is non-leaf and uses the direct-write convention: each
+//     caller stages the arg straight into the callee's
+//     analyzer-allocated param slot before the `JSR`. No
+//     transport, no prologue copy.
 //
 // What this exercises end-to-end:
 //   - Five levels of nested `JSR` without stack corruption
-//   - Parameter passing via `$04-$07` between callers
+//   - The hybrid leaf / non-leaf calling convention
 //   - Return value propagation through A
 //   - `fun ... -> u8 { return ... }` — the full typed-function
 //     shape, including an early `return` inside an `if`