codegen: emit gate markers at end of generate() to protect peephole

Move the six gate-marker label emissions (__mul_used, __div_used,
__oam_used, __default_sprite_used, __p1_input_used, __p2_input_used)
out of the inline IR-op lowering paths and into a new
`emit_trailing_markers()` helper that runs once at the end of
`generate()`. The IR walk now just flips a bool per marker; the
label emit happens after every instruction has been lowered, so
the marker never lands in the middle of a peephole-sensitive
sequence.

Fixes a real peephole interaction that surfaced after rebasing on
main's `codegen: skip parameter-spill prologue for leaf functions`
+ `peephole: drop dead LDA #imm before mem-INC/DEC + JMP`
improvements: an inline `__oam_used:` label inside `IrOp::DrawSprite`
split the dead-load-elimination block, leaving the `STA $130 /
LDA $130` redundant store+load pair that main's peephole would
otherwise have collapsed to a plain `LDA #imm`. The stale bytes
shifted the NMI handler by a few bytes, which shifted `on frame`
execution enough that `examples/palette_and_background.ne` captured
phase 1 (WarmReds) at frame 180 instead of phase 2 (CoolBlues).

Regenerates every example ROM against the new codegen (all gate
behaviour is unchanged — the linker still sees the same markers,
just at the tail of the user stream instead of interleaved) and
updates the goldens that shifted: seven audio-hash drifts (all
audio-bearing programs, same cycle-accurate-APU-timing story as
every prior NMI layout change) and two pixel goldens — the one-
pixel sprite-position drift in `comparisons.png` that we already
tolerate, plus the phase-capture flip in
`palette_and_background.png`.

https://claude.ai/code/session_016kM6P7PukktBDqTZexrrAN

tests/emulator/goldens/audio_demo.audio.hash

@@ -1 +1 @@
-b52a0b1e 132084
+23afaaa6 132084

tests/emulator/goldens/friendly_assets.audio.hash

@@ -1 +1 @@
-9387feb3 132084
+bc94ed30 132084

tests/emulator/goldens/noise_triangle_sfx.audio.hash

@@ -1 +1 @@
-a05d1284 132084
+52d1836f 132084

tests/emulator/goldens/platformer.audio.hash

@@ -1 +1 @@
-83c0eee4 132084
+ea23d9c4 132084

tests/emulator/goldens/pong.audio.hash

@@ -1 +1 @@
-b7d5b53f 132084
+555a22e1 132084

tests/emulator/goldens/sfx_pitch_envelope.audio.hash

@@ -1 +1 @@
-ff926f72 132084
+8142ffb7 132084

tests/emulator/goldens/war.audio.hash

@@ -1 +1 @@
-51b560a7 132084
+e3805766 132084