v0.7.0 — Real memory map (boots from cartridge ROM)

Real WonderSwan memory map — the machine boots from cartridge ROM.

Replaces the placeholder flat 1 MiB bus with core-ws::memory::MemoryMap, routing the physical address space per the verified spec (docs/hardware/01-cpu-v30mz.md):

• Internal RAM sized by model (16 KiB mono / 64 KiB colour), with the mono 0x04000+ hole left as an explicit open question rather than a fabricated mirror.
• Cartridge ROM bank windows — $C0 linear (masked to the mapper's width), $C2/$C3 ROM0/ROM1 — and the $C1 SRAM window, all driven off the decoded CartHeader (bus width, save/ROM sizing, mapper).
• I/O three-way decode ($B8–$BF EEPROM, $C0–$FF cartridge bus, SoC low-9-bit alias, else open bus) with model-dependent open-bus reads ($90 mono / $00 colour).
• $A0 system control — one-way boot-ROM lockout latch, colour status, and the ROM bus width seeded from the cartridge footer (community bug #9 flowing through to the runtime register).

Machine::with_cartridge now boots: reset FFFF:0000 → the linear window → the cartridge footer's boot far-jump → executing from ROM (test boots_from_cartridge_rom_via_the_reset_vector).

An adversarial review caught a boot-blocking bug before merge — $C0 powered up to 0, so the reset vector only reached the footer on ROMs ≤ 1 MiB; fixed to $FF and locked with a multi-size test (incl. 4 MiB). 153 tests pass in debug and release; CI green.

Deferred as explicit gaps: wiring the fixed subsystems to the I/O dispatch, the boot-ROM overlay, the EEPROM/RTC protocols, DMA, PPU rendering, and timing. Still not a playable emulator.