v2.64.0: cfg_sh2a: SH-2A control-flow graph builder.

cfg_sh2a: SH-2A control-flow graph builder.

New module: ablation/analyzers/cfg_sh2a.py.

3 things that were not possible before in Ablation:

1. No CFG for SH-2A. Every other ISA with a lifter backend also had a CFG
   module; SH-2A was the only exception. Without a CFG, the structurizer and
   DomTree cannot run on SH-2A firmware.
2. No delay-slot semantics in any CFG builder. SH-2A's delay-slot model
   (one instruction always executes after a branch before the branch fires) is
   architecturally distinct from all prior CFG modules (ARM, V850, ARC, x86).
   cfg_sh2a correctly attaches the delay-slot instruction to the terminating
   block so successor VAs are computed from after the delay slot, not from
   after the branch.
3. No .flow / .flow_r() interface on SH-2A CFG. dataflow_engine.DomTree
   and all backward-dataflow passes require these. cfg_sh2a.CFG adds both
   as computed properties.

New:

• Block(start, insns, succs, preds): basic block for SH-2A. Delay-slot
  instruction is the last insns entry when the terminator has a delay slot.
• CFG(blocks, entry) with .flow property and .flow_r() method for
  duck-type compatibility with dataflow_engine.CFG.
• build_cfg(insns, entry=None) -> CFG: three-pass construction
  (leader scan → partition → edge fill).
• Delay-slot semantics: WITH delay slot = {bra, bsr, jsr, bt/s, bf/s, rts, rte};
  WITHOUT = {bt, bf, rts/n}. BRAF/BSRF/JMP@Rn decode as MISC → open blocks
  (documented limitation).
• Compatible with DomTree, LoopInfo from dataflow_engine via duck typing.
• Docs: docs/module-reference/cfg-sh2a.md.

---