PHLEGM v8 - checkpoint 50 / SNES APU mailbox timing and first driver calls

Evidence from the three 2026-1010 SNES coredumps:
- SPC IPL transferred 2,893 bytes, started at $0400, but ARAM[$0400]=$01
  while the supplied standard ActRaiser US ROM has $20 at that location.
- ARAM[$0401..$0F4C] exactly matches the first 2,892 bytes of the ROM's
  $0B4D-byte ($0400) sound driver. This is a one-byte pipeline delay.
- The main CPU is alive, SPC700 immediately TRAPped on $01 at $0400,
  and PPU INIDISP=$80 (forced blank).
- CPU register pairs $2140/$2141 may be written together by 16-bit stores;
  the SPC cannot process the low byte synchronously before the high byte.

Implementation:
- Defer APUIO0 IPL handling until the S-SMP support device advances;
  the SPC then samples current APUIO1 data from the other physical latch.
- Keep only the latest pending APUIO0 value if the CPU writes repeatedly
  before an S-SMP clock tick. Reset/restore clears transient pending state.
- No cartridge-specific matching, ROM patches, invented driver responses,
  or hard-coded CPU instruction implementations.
- Add 4 SPC700 scripts for instructions exercised early in ActRaiser's
  uploaded sound driver: CALL absolute, RET, MOV (X)+,A, CMP X,#imm.
  The two new CALL and RET actions are generic runtime VM primitives;
  the per-opcode behavior remains in spc700-opcodes.config.phlegm.
- Other SPC700 opcodes continue to trap explicitly.

Validation required:
- Rebuild Windows and Linux targets using your native FreeBASIC toolchains.
- With the original unmodified ActRaiser ROM, compare ARAM $0400 bytes and
  the SPC fault PC; check that display eventually exits forced blank.
- No claim that ActRaiser completes startup: further SPC700 opcodes are
  intentionally unimplemented, S-SMP timers and S-DSP remain incomplete.
