feat(mhfu): one memory interface and the overlay and EBOOT analysis on rabbitizer

[sp00ktober]

Part of sp00ktober/MHFU-ModKit#62 (the offline half; the live half is stacked on this PR).

• One memory interface: Live over ppsspp-debug, Image for a RAM dump, an overlay or BOOT.BIN, Space for several. Typed views take offset and type from addresses.toml, and a mismatch fails at import.
• mips.Code on rabbitizer (Allegrex): functions, calls with vtable slots and tail calls, lui/lo pairs through its RegistersTracker, switches, constants. It replaces mips_dis.py, capstone and the bit masking.
• One mhfu CLI:
  • dis, xref, switch, reloc
  • moveset, phases, chain, effects, attacks, abi, census
  • intel --all (schema mhfu.species_intel/1 kept, so the monster editor still reads it)
  • hitzones, hitboxes, stage, inject, addresses
• census skips transitions a script forced (FORCED in the log) and the visits they cut short, so it measures only what the monster chose; intel reports how many it skipped. The old tool counted them.
• MIT, no mhp-formats dependency: inject takes finished bytes, and the stage file codec stays in mhp-formats.

Old bugs fixed, found by comparing old and new on all 17 em overlays, 267 stage overlays, game_task, game_sub and BOOT.BIN:

• An overlay's text section starts at 0x40, not 0x80. The old layout hid em55/em59's attack tables (now 26 and 10 attacks) and ran 14 overlays' data past their file.

• The relocator:

  • moved game_sub's bss as if it were an em "lower BSS" (169 references);
  • overshot the footprint end;
  • missed 24 luis in delay slots and the ctor range.

  The framework's C port has the same bugs, now an item in Behaviour graph: a node canvas replaces the rule list #65.

• The 16 st046 variant PACs (file_06074..06089) were missing, and stage 0's PAC id pointed at stage266.ovl.

• Tail and virtual tail calls: pairs that hand off went from 806 to 1581, and abi callers 8 from 29 to 95.

• Constant reads now follow register moves, pointer arguments, branch-likely delay slots and every path. They also no longer stop at a 3000-instruction cut-off, and em_effects no longer crashes on em07.

Test plan

• uv run pytest: passes without game data, and with MHFU_DATA
• Installed from the wheels: mhfu intel --all writes all 17 species files in 8 s, and the monster editor loads them
• spimdisasm agrees on every lui/lo pair and jump in the em, stage, task and sub overlays

🤖 Generated with Claude Code