Codegen: MMC3 on_scanline IRQ dispatch (minimal)

Wires \`on scanline(N)\` handlers through IR lowering and codegen:

- IR lowering: each scanline handler becomes a regular IR function
  named \`{state}_scanline_{N}\`
- IR codegen: when any scanline handler exists, emits MMC3 IRQ setup
  at program start (\$C000 latch, \$C001 reload, \$E001 enable, CLI)
  and a \`__irq_user\` handler that saves registers, acknowledges via
  \$E000, JSRs the scanline handler, restores registers, and RTIs
- Linker: vector table prefers \`__irq_user\` over the default \`__irq\`
  stub when both exist

Scope of this first pass is intentionally minimal: supports ONE
scanline handler per program (the first one found in IR function
order). Per-state dispatch and multi-scanline reload will come later.

https://claude.ai/code/session_01W6eQFStA66EuMKHUFo2rx3

src/ir/lowering.rs

@@ -215,6 +215,14 @@ impl LoweringContext {
         if let Some(on_frame) = &state.on_frame {
             self.lower_handler(&format!("{}_frame", state.name), on_frame, state);
         }
+
+        // Lower each scanline handler as a function named
+        // `{state}_scanline_{N}`. The IR codegen will generate the MMC3
+        // IRQ dispatch wrapper separately.
+        for (line, block) in &state.on_scanline {
+            let name = format!("{}_scanline_{line}", state.name);
+            self.lower_handler(&name, block, state);
+        }
     }
 
     fn lower_handler(&mut self, name: &str, block: &Block, state: &StateDecl) {