fix(video): model the real unit's VR319 monitor

The harness forced the VR150 monitor switch, so the firmware wrote the OS
screen at 1024 px / 128-byte rows.  VT1200_VRAM_REAL then re-read that
framebuffer at the VR319 pitch, which sheared the OS and wrapped the right
quarter of every row.

Model VR319 (switch 0x60) by default -- the real unit's mode -- so the
firmware itself programs 1280x1024 with a 256-byte row pitch (CONVDP=0x14).
The renderer's pitch follows VT1200_MONITOR, and the destination span now
comes from HEBLNK..HSBLNK instead of x=0, placing the active 1280 px at
x=336 in MAME's 1696-wide raster.

Verified: clean Terminal Manager at frame 600, legible faithful diagnostics
menu and level-1 error screens, tile mode PASS with tile_check 1280/1280
tiles, tablet/mouse pixel-identical.  VT1200_MONITOR=VR150 reproduces the
old geometry; the regression baseline moves 198 -> 199 (2 PCs) and is
recorded in harness/mame/README.md.

README.md

@@ -262,19 +262,23 @@ Messages, Ethernet/IP/LAT, a Memory bar, and "All Diagnostics Passed". The
 keyboard and mouse drivers initialise and speak the real protocol; the LANCE is
 initialised and the TM shows the real hardware address
 `08-00-2B-16-4B-5A`. Evidence frames: `harness/mame/skip_frame3000.png`,
-`duart2_default_tm_frame3000.png`, `tablet_cursor_*.png`.
+`duart2_default_tm_frame3000.png`, `tablet_cursor_*.png` (VR150 captures; the
+VR319 default renders the same UI at the real 1280-px placement — see
+`harness/mame/RENDER_REPORT.md` §8).
 
 ### Regression baseline
 
 `progress.lua` at 200 frames, **no env**:
 
 ```
-PC=3FDCE400 samples=198 (3 distinct PCs)
+PC=3FDCE400 samples=199 (2 distinct PCs)
 ```
 
-It is a change detector, not a specification. It has moved twice, both
-deliberately; `harness/mame/README.md` records why, including the
-`VT1200_IO_PATH_STUB=1` value (`samples=53`, 75 PCs) as a separate baseline.
+It is a change detector, not a specification. It has moved three times, all
+deliberately; `harness/mame/README.md` records why, including the monitor-default
+move (VR319 is the real unit's mode) and the `VT1200_IO_PATH_STUB=1` values
+(`samples=97` at the VR319 default, `samples=53` with `VT1200_MONITOR=VR150`) as
+separate baselines.
 
 ### Deliberate divergences
 
@@ -284,8 +288,7 @@ deliberately; `harness/mame/README.md` records why, including the
 | `VT1200_SKIP_LEVEL1` | off | DUART1 IP3 high → skip all level-1 tests | leave unset |
 | `VT1200_IO_PATH_STUB` | off | 10 bytes after the level-0 `0xE1` write | leave unset |
 
-The full env-knob table (21 knobs, down from 33) is in
-`harness/mame/README.md`.
+The full env-knob list is in `harness/mame/README.md`.
 
 ---