examples: 4 new programs covering MMC3 + other e2e gaps

Four new examples bring total coverage to 18/18 ROMs through
the jsnes smoke test:

- mmc3_per_state_split.ne — two states, each with their own
  `on scanline(N)` handler at a different line (80 vs 160).
  Pressing START transitions between them. Verifies the
  per-state MMC3 IRQ dispatch: the `__ir_mmc3_reload` helper
  CMPs `current_state` on every NMI and writes the right
  latch value to `$C000`/`$C001`, and `__irq_user` runs the
  current state's handler when the counter fires. This is
  the first example that exercises the per-state reload logic
  at runtime, not just at compile-time.

- two_player.ne — exercises `p2.button.*` reads alongside
  the default (P1) `button.*`. Two independently-moveable
  sprites sharing a single frame handler and the runtime OAM
  cursor. The runtime's NMI controller poll already reads
  both `$4016` and `$4017`, but until this example no
  runtime test actually looked at `$08` (the P2 input byte).

- function_chain.ne — five-deep user-function call chain
  (`frame -> compute -> scale -> clamp -> fold -> taper`)
  with parameter passing through ZP `$04-$07` and return
  values through A. Early returns inside nested `if`s,
  handler-local result var, mixed shift + additive transforms.
  Catches any regression in: JSR stack discipline, param slot
  layout, RTS stack unwinding, return-value flow, or the
  analyzer's call-graph / max-depth computation.

- comparisons.ne — one `if` per comparison operator
  (`==`, `!=`, `<`, `<=`, `>`, `>=`) gated on a u8 ramping
  through 0..255. Each `if` drives a pip sprite at a fixed
  column. Exercises every `CmpKind::*` case in the IR
  codegen's `gen_cmp`, catching regressions in branch-opcode
  selection (BEQ/BNE/BCC/BCS) and inverted-branch peephole
  folding.

Smoke test deltas (all 18/18 pass, with per-example floors):

    comparisons           208  (floor 150)
    function_chain        104  (floor 100)
    mmc3_per_state_split  104  (floor 80)
    two_player            104  (floor 100)

`tests/emulator/run_examples.mjs` gets new `EXAMPLE_FLOORS`
entries for each, with notes describing the expected content
so a regression prints a helpful reason.

cargo test (313 unit + 37 integration), cargo fmt --check,
cargo clippy --release -- -D warnings all clean.

https://claude.ai/code/session_014Z5y3Q9krLcAxYpZQJhZ5V

tests/emulator/run_examples.mjs

@@ -36,6 +36,13 @@ const EXAMPLE_FLOORS = {
   structs_enums_for: [200, "player + 4 enemies drawn by a `for` loop"],
   sprites_and_palettes: [60, "custom CHR tiles visible"],
   scanline_split: [80, "banner + player"],
+  mmc3_per_state_split: [80, "marker + player in the split-screen state"],
+  two_player: [100, "two player sprites drawn independently"],
+  function_chain: [100, "player swept by chained function return + a static marker"],
+  // `comparisons` has at least `value != MIDPOINT` true for 255 of
+  // 256 frames, plus either `<`/`<=` or `>`/`>=`, plus the player.
+  // That's 4+ sprites on most frames.
+  comparisons: [150, "player + pips for each true comparison against MIDPOINT"],
 };
 
 async function listRoms() {