fix(z80): pass memory parameters through callee spill slots

[oisee]

Problem and behavior

When PBQP assigns a callee parameter to memory, production call setup writes it to the allocator's provisional $F0xx address. The callee reads its named _spill_<callee>_rN slot, so the value never arrives. Call setup now targets the same spill label that codegen emits for the callee. Indirect and external calls keep their existing ABI paths.

Validation

• A new Z80 assembler/emulator regression passes a u16 value through the callee's spill slot and reads back the exact value. It fails with the old $F072 destination.
• A retained Nanz repro from the P8 critic now executes a dynamic tail call through a spilled parameter: before this change Z80 returned 59750 against MIR2's 4430; after, Z80 returns 4430. The new pipeline regression runs this source through the emulator and checks the dynamic call remains present.
• On the critic's retained gen3.py noshift seeds 0–149, Z80 source assertions pass 0/150 on fix(assert): initialize spilled Z80 parameters in direct-call bootstrap #68 and 4/150 with this fix; all 150 still assemble. This is a narrow improvement, not a claim that the generator is solved.
• go test -short -timeout 5m ./pkg/mir2/... ./pkg/pipeline/... passes.
• Direct-call fuzz seeds 0–299 have the same classification before and after this fix (80 pass, 134 Z80/MIR2 wrong values, 79 execution errors, 7 MIR2/oracle findings). That generator calls its entry via the assertion bootstrap and does not establish an improvement in production-call correctness. The focused test covers the changed ABI path.

[github-actions]

PR tests: 🟢 pass

Commit: 5cf9c766 · Full test log

Check	Result
Build mz, mza, mze, mzv	🟢 pass
Stable Go package tests	🟢 pass
Fibonacci compile + assemble	🟢 pass
Nanz language regressions	🟢 pass
Z3 West of House demo	🟢 pass
Z3 small conformance fixtures	🟢 pass

The external CZECH and full Zork I stories are not part of this PR gate.