First exact native PPU checkpoint for the TD2 port

This checkpoint moves the new port/ runtime past the bootstrap blit stage.

The promoted fixtures are now rendered natively from raw SNES-visible state instead of copying main_visible.ppm into the SDL framebuffer. The runtime now:

• loads ppu_state.json alongside vram.bin, cgram.bin, and oam.bin
• seeds BG layer registers, Mode 7 registers, and OAM state into Td2PpuState
• rasterizes BG, OBJ, and Mode 7 directly from that state in C
• keeps main_visible.ppm only as the regression golden surface

The first promoted exact-native fixtures are:

• frame 300: credits / copyright scene
• frame 1086: Mode 7 plus OBJ gameplay scene

Current bounded validation remains simple and cheap:

make -C port
./port/test_regression.sh

Both fixtures are still at 0 mismatched pixels after the switch.

One practical cleanup also landed with this step: the larger runtime state now lives on the heap instead of the stack, which avoids instability as the SNES-side caches grow.

Next gate: add the Zelda3-style side-by-side compare lane so callback/state drift is reported automatically against trusted traces.