PHLEGM v8 Checkpoint 58 - S-SMP Hardware Timers (ActRaiser)

Reproduced from six 2026-1010 11:39-11:40 core dumps:
  SPC700 keeps executing at $0460/$0462 with no fault.
  $0460 EB FD  = MOV Y,$FD   (read timer 0 output and clear)
  $0462 F0 FC  = BEQ $0460  (wait for nonzero timer tick)
  $F1=01 enables timer 0; $FA=10 programs divider target $10.
  All six captures had the CPU waiting at $02:9A63 for the APU handshake,
  with $2100=80 forced blank and the APU output ports $50,$BB.
  Implementing opcode inventory did not implement hardware timer output.

This checkpoint implements clock-driven S-SMP timers 0/1/2:
  $FA/$FB/$FC write-only timer targets (0 means 256 stage-2 ticks);
  $FD/$FE/$FF read-and-clear 4-bit output counters;
  timer 0 and 1 prescalers clock at 1,024,000 / 128 = 8kHz;
  timer 2 prescaler clocks at 1,024,000 / 16 = 64kHz;
  $F1 bits 0-2 enable timers, resetting stage-2/3 on a 0->1 edge;
  stage-1 scalers free-run independently of the enable mask;
  memory underneath I/O remains writable, outputs are read-only.
  Timer clock advances per executed instruction, not by wall time.

Snapshot format v5 saves timer prescalers, dividers, targets and outputs.
Version 4 snapshots are accepted and targets reconstructed from ARAM.
COREDUMP APU and forensic dumps now show detailed timer state.

Limitations: native FreeBASIC compile and ActRaiser execution not run here.
S-DSP audio synthesis remains incomplete, as do full SPC700 correctness
tests against reference hardware. No ROMs or firmware included.
