Runtime region-writes (on-disk ROM untouched) applied after the level-0 ROM
checksum:
three known failing checks: 3FA73980 CA04->C004, 3FA76060 CB04->C004,
3FA760F0 CB04->C004 (skip the c6/c0/c1 flag stores)
VT1200_L1PATCH_EXTRA adds the second-round checks 3FA761F0 / 3FA763A0
(the retry loop reaches c3/c2 once c0/c1 stop short-circuiting)
VT1200_L1PATCH_VERDICT optionally forces L3FA6E4B0's return (3FA71B60
4D28 move a9,a8 -> 5708 clr a8)
With the five branch patches the HOST PORT test's caller returns 0 and no
'HOST PORT - 15' is printed, but level 1 does not complete: the CPU stays in
the DUART ISR chain (INT1 0x0F60 -> 3FA92F40 -> L3FA78D90 -> 3FA78xxx-3FA7Bxxx)
for >19000 frames with no error. l1p_pie_frame1500.png is a frame dump of the
self-test circle/pie -- the renderer draws curves, fills and blits correctly.
