fix(assert): initialize spilled Z80 parameters in direct-call bootstrap

[oisee]

Problem and behavior

A direct assert f(args) via z80 can allocate a parameter to memory. The assertion bootstrap emitted LD mem, 5738, which is invalid Z80 and does not address the named spill slot used by the function. This change initializes that exact spill label byte by byte before setting register arguments. Sandbox trampolines now use the actual instruction size to keep their code and data addresses stable across assertions. Advisory lint is scoped to changed Go packages, avoiding unrelated optional graphics type-check failures.

Evidence

On the same direct-call seeds 0–2999, using the #67 baseline and this PR's GitHub CI artifact:

Result	Before	After
Pass	89	836
Assembly failure	2494	0
Z80≠MIR2 wrong value	207	1314
Compiler/execution error	196	788
MIR2≠oracle	14	62

The increased wrong-value and execution counts are previously masked cases, not regressions established by this comparison. Direct-call fuzz remains report-only; production calling and arithmetic still need fixes.

Validation

• New assembly/emulator regression verifies a spilled u16 argument and an A-register argument reach the callee intact.
• go test -short -timeout 5m ./pkg/pipeline/... ./pkg/mir2/... passes.
• GitHub CI direct-call fuzz on seeds 0–2999 has no assembly failures; independent source/MIR2/Z80 results and reproducers are attached to the workflow run.
• Changed-package advisory lint and formatting checks pass locally.

[github-actions]

PR tests: 🟢 pass

Commit: ad47044c · Full test log

Check	Result
Build mz, mza, mze, mzv	🟢 pass
Stable Go package tests	🟢 pass
Fibonacci compile + assemble	🟢 pass
Nanz language regressions	🟢 pass
Z3 West of House demo	🟢 pass
Z3 small conformance fixtures	🟢 pass

The external CZECH and full Zork I stories are not part of this PR gate.