Codegen: MMC3 on_scanline IRQ dispatch (minimal)

Wires \`on scanline(N)\` handlers through IR lowering and codegen:

- IR lowering: each scanline handler becomes a regular IR function
  named \`{state}_scanline_{N}\`
- IR codegen: when any scanline handler exists, emits MMC3 IRQ setup
  at program start (\$C000 latch, \$C001 reload, \$E001 enable, CLI)
  and a \`__irq_user\` handler that saves registers, acknowledges via
  \$E000, JSRs the scanline handler, restores registers, and RTIs
- Linker: vector table prefers \`__irq_user\` over the default \`__irq\`
  stub when both exist

Scope of this first pass is intentionally minimal: supports ONE
scanline handler per program (the first one found in IR function
order). Per-state dispatch and multi-scanline reload will come later.

https://claude.ai/code/session_01W6eQFStA66EuMKHUFo2rx3

src/linker/mod.rs

@@ -130,10 +130,17 @@ impl Linker {
         }
         prg.resize(vector_offset, 0xFF);
 
-        // Write vector table
+        // Write vector table. IR codegen emits a richer IRQ handler
+        // under `__irq_user` when the program has scanline handlers;
+        // prefer that over the generic RTI stub at `__irq`.
         let nmi_addr = result.labels.get("__nmi").copied().unwrap_or(0xC000);
         let reset_addr = result.labels.get("__reset").copied().unwrap_or(0xC000);
-        let irq_addr = result.labels.get("__irq").copied().unwrap_or(0xC000);
+        let irq_addr = result
+            .labels
+            .get("__irq_user")
+            .or_else(|| result.labels.get("__irq"))
+            .copied()
+            .unwrap_or(0xC000);
 
         prg.extend_from_slice(&nmi_addr.to_le_bytes());
         prg.extend_from_slice(&reset_addr.to_le_bytes());