compiler: audio driver, u16 arithmetic, multi-scanline, slot recycling

Five language features and optimizations from the planned-work backlog:

- **Minimal audio driver**: `play`/`start_music`/`stop_music` now generate
  APU pulse-1/pulse-2 writes from a builtin SFX/music name table, and
  the NMI handler gains a `JSR __audio_tick` splice (via the linker's
  `__audio_used` marker lookup) that ages an SFX countdown counter and
  mutes pulse 1 when the tone expires. Programs that never trigger
  audio pay zero ROM cost.

- **u16 arithmetic and comparisons**: new IR ops `LoadVarHi`, `StoreVarHi`,
  `Add16`, `Sub16`, and six `Cmp*16` variants. The lowering context
  tracks variable types via the analyzer's symbol table and routes
  expressions through the 8-bit or 16-bit path based on operand width.
  Add16 emits `CLC;ADC;ADC` with carry propagating naturally into the
  high byte; compares dispatch high-byte-first with a short-circuit
  low-byte fallback. Fixes a silent miscompile where `big += 1` on a
  u16 var only incremented the low byte.

- **Multi-scanline handlers per state**: `gen_scanline_irq` now
  dispatches on `(current_state, ZP_SCANLINE_STEP)` and reloads the
  MMC3 counter with the delta to the next scanline in the same state.
  `gen_scanline_reload` resets the step counter at the top of each
  NMI so a state with multiple handlers fires them in ascending line
  order. Previously only the first handler per state ever fired.

- **IR temp slot recycling**: `build_use_counts` pre-scans each
  function to count per-temp uses; `retire_op_sources` decrements
  the counts after each op and pushes dead slots back onto
  `free_slots` for later allocation. `bitwise_ops.ne` used to crash
  (debug) or miscompile (release) once it hit 128 concurrent temps;
  with recycling the same function now uses ~4 slots instead of 136.

- **INC/DEC peephole fold + improved dead-load elimination**:
  `fold_inc_dec` collapses `LDA addr; CLC; ADC #1; STA addr` into
  a single `INC addr` (and the SEC/SBC variant into `DEC addr`),
  saving 5 bytes and 5 cycles per increment. The fold is suppressed
  when the next instruction reads carry. `remove_dead_loads` now
  walks past INC/DEC/STX/STY (which don't touch A) to find the
  actual next A-use, catching more dead loads.

Tests: 331 unit + 39 integration (up from 313 + 37), including new
guards for audio, u16, multi-scanline, and slot recycling.

https://claude.ai/code/session_01A8qk3gw2jWSzdiXBZPZSFE

src/ir/mod.rs

@@ -155,6 +155,103 @@ pub enum IrOp {
     /// `peek(addr)` — LDA from a fixed absolute address into a temp.
     Peek(IrTemp, u16),
 
+    // 16-bit operations — emitted for u16-typed expressions and
+    // assignments. Each wide value is carried as a pair of 8-bit
+    // temps `(lo, hi)`, so the existing temp-slot allocator still
+    // works without modification.
+    /// Load the high byte of a u16 variable (var address + 1).
+    /// The existing `LoadVar` is repurposed as "load the low byte"
+    /// because it loads from the var's base address — which is the
+    /// low byte of a little-endian u16.
+    LoadVarHi(IrTemp, VarId),
+    /// Store the high byte of a u16 variable (var address + 1).
+    StoreVarHi(VarId, IrTemp),
+    /// 16-bit add: `(d_lo, d_hi) = (a_lo, a_hi) + (b_lo, b_hi)`.
+    /// Codegen emits `CLC; LDA a_lo; ADC b_lo; STA d_lo; LDA a_hi;
+    /// ADC b_hi; STA d_hi` — the ADC for the high byte propagates
+    /// the carry flag set by the low-byte addition.
+    Add16 {
+        d_lo: IrTemp,
+        d_hi: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit subtract: `(d_lo, d_hi) = (a_lo, a_hi) - (b_lo, b_hi)`.
+    /// Uses SEC; SBC to propagate borrow through the high byte.
+    Sub16 {
+        d_lo: IrTemp,
+        d_hi: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit equality comparison; `dest = (a == b) ? 1 : 0`.
+    /// Lowered as two CMPs with a short-circuit on the low byte.
+    CmpEq16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit not-equal comparison.
+    CmpNe16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit unsigned less-than. `dest = (a < b) ? 1 : 0`.
+    /// Codegen compares high bytes first; falls through to compare
+    /// low bytes only when the high bytes are equal.
+    CmpLt16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit unsigned greater-than.
+    CmpGt16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit unsigned less-or-equal.
+    CmpLtEq16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+    /// 16-bit unsigned greater-or-equal.
+    CmpGtEq16 {
+        dest: IrTemp,
+        a_lo: IrTemp,
+        a_hi: IrTemp,
+        b_lo: IrTemp,
+        b_hi: IrTemp,
+    },
+
+    // Audio ops — map to the minimal APU driver emitted by the linker.
+    /// `play SfxName` — trigger a one-shot sound effect on pulse 1.
+    /// The sfx name is looked up in a builtin table; unrecognized names
+    /// play a generic beep.
+    PlaySfx(String),
+    /// `start_music TrackName` — play a sustained tone on pulse 2 until
+    /// `stop_music`. The track name is hashed into a tone parameter.
+    StartMusic(String),
+    /// `stop_music` — silence the music channel (pulse 2) and any
+    /// currently-playing SFX tail.
+    StopMusic,
+
     // Source mapping
     SourceLoc(Span),
 }