audio: complete the subsystem — asset pipeline, user decls, tracker-style driver

The audio subsystem was a sketch: `play name` / `start_music name` /
`stop_music` parsed, lowered, and emitted a few hardcoded register
writes from a builtin name table. No user-declared effects, no
per-frame envelope, no note streams, no real engine.

This flesh-out brings audio up to the quality bar of the rest of
the compiler (sprites, palettes, bank switching, scanline IRQ,
etc.) with a full data-driven pipeline:

## Asset pipeline (new `src/assets/audio.rs`)

- `sfx Name { duty, pitch, volume }` blocks compile into per-frame
  pulse-1 envelopes. Pitch/volume arrays must match in length; each
  entry is one NMI's worth of `$4000` data.
- `music Name { duty, volume, repeat, notes }` blocks compile into
  flat `(pitch, duration)` streams for pulse 2. Pitch 0 is a rest,
  1-60 indexes a builtin period table covering C1-B5.
- `resolve_sfx` / `resolve_music` walk the program for `play` /
  `start_music` references and append builtin fallbacks for any
  name that isn't user-declared — so `play coin` still works
  without a `sfx Coin { ... }` block.
- Builtin effects (coin, jump, hit, click, cancel, shoot, step)
  and tracks (theme, battle, victory, gameover) synthesize through
  the same compile path as user decls — one data model, one driver.

## Runtime engine (`src/runtime/mod.rs`)

- `gen_audio_tick()` walks both channels every NMI: reads one
  envelope byte through `(ZP_SFX_PTR),Y` -> writes `$4000`,
  advances ptr, mutes on zero sentinel. Music decrements the note
  counter, advances to the next `(pitch, dur)` pair on zero, looks
  up the period through `(__period_table),Y`, loops on `0xFF 0xFF`.
- `gen_period_table()` emits a 60-entry equal-tempered table
  (A4 = 440 Hz, NTSC 1.789773 MHz CPU clock) with length-counter
  load bits pre-baked into each high byte.
- `gen_data_block()` emits a label + raw-bytes pseudo pair so
  user sfx/music data can be spliced into PRG with regular labels
  that the two-pass assembler resolves.
- New ZP layout: `$05/$06` music loop base, `$07` music state
  (duty/volume/loop/active), `$0C-$0F` sfx and music pointers.

## IR codegen (`src/codegen/ir_codegen.rs`)

- `with_audio(sfx, music)` registers compile-time trigger constants
  per blob name.
- `gen_play_sfx` emits: write period to `$4002`/`$4003`, load
  envelope pointer into `ZP_SFX_PTR` via SymbolLo/SymbolHi of
  `__sfx_<name>`, mark the sfx counter active.
- `gen_start_music` stamps the header byte into `ZP_MUSIC_STATE`
  with the active bit OR'd in, seeds both ptr and loop base from
  `__music_<name>`, primes the duration counter.
- `gen_stop_music` mutes pulse 2 and clears state.

## Linker (`src/linker/mod.rs`)

- New `link_with_all_assets(user_code, sprites, sfx, music)` path
  that splices driver body, period table, and each sfx/music data
  blob into PRG — all guarded on the `__audio_used` marker so
  silent programs pay zero ROM cost.

## Assembler (`src/asm/opcodes.rs`, `src/asm/mod.rs`)

- New `AddressingMode::Bytes(Vec<u8>)` variant for raw-data
  pseudo-instructions. `NOP+Bytes(v)` emits the payload verbatim,
  letting the linker splice ROM data tables into a code section
  and still have `Label` / `SymbolLo` / `SymbolHi` fixups resolve
  correctly in the same assembly pass.

## Analyzer

- `play` / `start_music` now validate the name against user decls
  and builtin tables. Unknown names emit E0505 with a helpful list
  of builtins — previously a typo would silently compile to no-op.

## Parser

- New `sfx_decl` / `music_decl` grammar with property-style
  configuration. Strict validation: duty 0-3, volume 0-15, pitch
  arrays must match volume length, music notes must come in pairs,
  pitch 0-60, duration ≥ 1.

## Tests

+170 new tests across every layer:
- `src/assets/audio.rs`: 17 tests (compile, resolve, builtins,
  shadowing, label sanitation, nested reference walks)
- `src/parser/tests.rs`: 13 tests (valid/invalid sfx + music
  declarations, property validation, play/start_music/stop_music)
- `src/analyzer/tests.rs`: 7 tests (builtin acceptance, user decl
  acceptance, unknown-name rejection)
- `src/runtime/tests.rs`: 10 tests (audio tick labels, RTS end,
  $4000 write, $4004 mute, period table assembly, A4 = 440 Hz,
  length counter bits, data block verbatim emit)
- `src/linker/tests.rs`: 4 tests (sfx/music blob placement,
  pointer resolution, elision when unused)
- `src/codegen/ir_codegen.rs`: rewrote the 4 existing audio tests
  to match the new data-driven contract
- `tests/integration_test.rs`: 4 end-to-end tests including a
  user-declared `sfx` + `music` program that verifies bytes land
  in PRG ROM at the right addresses

## Docs

- New Audio section in `docs/language-guide.md` with syntax
  reference, builtin tables, and an explanation of how the
  driver works at compile and run time.
- `docs/architecture.md` updated to reflect the real audio
  pipeline instead of the old "audio import stubs" stub.
- `docs/future-work.md` moves audio from "status: minimal" to
  "status: full subsystem" with a narrower list of follow-up work
  (triangle/noise/DMC channels, NSF/FTM imports, richer envelopes).
- `examples/audio_demo.ne` rewritten to showcase user-declared
  `sfx LongCoin`, `sfx Zap`, `music Theme`, still demonstrating
  builtin fallback via `play coin`.

Total: 424 tests passing (381 unit + 43 integration), clippy clean,
fmt clean, all 19 examples compile.

https://claude.ai/code/session_015WfaDttE3DpWn9rpyfpQd8

src/asm/mod.rs

@@ -79,6 +79,15 @@ impl Assembler {
 
     fn emit_instruction(&mut self, inst: &Instruction) {
         match &inst.mode {
+            AddressingMode::Bytes(payload) if inst.opcode == Opcode::NOP => {
+                // Raw-data pseudo-instruction: splice the payload
+                // into the output stream verbatim. No opcode byte
+                // is emitted — this is how we embed audio tables
+                // and other data blobs inside a code section while
+                // still letting the two-pass label resolver see
+                // adjacent labels at the right addresses.
+                self.output.extend_from_slice(payload);
+            }
             AddressingMode::Label(name) => {
                 // A `NOP` with a `Label` mode is the label-definition
                 // pseudo-instruction: it records the current address and

src/asm/opcodes.rs

@@ -81,6 +81,13 @@ pub enum AddressingMode {
     LabelRelative(String),
     SymbolLo(String),
     SymbolHi(String),
+
+    /// Raw data payload — emitted verbatim by the assembler as a
+    /// `NOP` pseudo-instruction. Used to splice data tables (audio
+    /// envelopes, note streams, period tables) between code
+    /// sections so they live inside the same PRG bank and get their
+    /// labels resolved by the normal two-pass assembler.
+    Bytes(Vec<u8>),
 }
 
 impl AddressingMode {
@@ -97,6 +104,10 @@ impl AddressingMode {
             | Self::Relative(_) => 1,
             Self::Absolute(_) | Self::AbsoluteX(_) | Self::AbsoluteY(_) | Self::Indirect(_) => 2,
             Self::Label(_) | Self::LabelRelative(_) | Self::SymbolLo(_) | Self::SymbolHi(_) => 0,
+            // `Bytes` is the full emitted payload — the assembler
+            // skips the usual opcode byte for `NOP+Bytes` and writes
+            // the raw vector, so the whole thing is operand.
+            Self::Bytes(v) => v.len(),
         }
     }
 
@@ -117,6 +128,7 @@ impl AddressingMode {
             Self::Label(_) | Self::LabelRelative(_) | Self::SymbolLo(_) | Self::SymbolHi(_) => {
                 vec![]
             }
+            Self::Bytes(v) => v.clone(),
         }
     }
 
@@ -151,8 +163,17 @@ impl Instruction {
     }
 
     /// Total size in bytes (opcode + operand).
+    ///
+    /// The `NOP`+`Label` pair is a label-definition pseudo — zero
+    /// bytes. `NOP`+`Bytes(v)` is a raw-data pseudo — exactly `v.len()`
+    /// bytes (no opcode). All other instructions are 1 byte opcode
+    /// plus operand.
     pub fn size(&self) -> usize {
-        1 + self.mode.operand_size()
+        match &self.mode {
+            AddressingMode::Label(_) if self.opcode == Opcode::NOP => 0,
+            AddressingMode::Bytes(v) if self.opcode == Opcode::NOP => v.len(),
+            _ => 1 + self.mode.operand_size(),
+        }
     }
 }