Inline dynamic-name rendering fix

Frozen runtime change: three guarded tail calls, nine code bytes, no allocation.
API: apply_inline_name_fix.apply(original_rom_bytes, current_english_rom_bytes)
returns (patched_bytes, report). Apply after the existing translation modules
and calculate the final SNES checksum afterward. inline-name-patch.json holds
the exact changes and context guards for all three original text engines.

Cause: after a newline, the original parser can set up a name without reading
its first glyph. The renderer then uploads the previous two-glyph work buffer
at the previous row's far-right pair. It visibly duplicates AS, OBU or O, in
the opening, Ski Club and Air Flight interview. The replacement tail-calls the
existing native name reader immediately, so a real glyph and correct cursor
are ready for that frame. No script, font, pointer or save-layout data changes.

Validation:
  Published natural checkpoints reproduce all three reported artifacts.
  The fixed candidate clears the exact affected BG3 pixels in all three.
  Fresh input-only opening routes with defaults, one-letter names, longest
  accepted names, and deleted fields restored to defaults all reach home.
  11,502 direct native setup cases cover 1,917 English/Japanese glyph values,
  all three engines, and fresh-line/newline counter contexts. First glyph,
  glyph counter, name pointer, active-name flag, register widths and stack match.
  9,202 per-frame NMI canary checks pass in checkpoint/save regressions.
  A normal published-version game save loads on the fixed ROM with names,
  date, progress flags and stats exact. No user saves were read or overwritten.

Compatibility: normal SRAM game-save format is unchanged and was tested.
An old emulator snapshot may already contain the stale graphic in VRAM until
the next text-page redraw. Cross-version snapshots are not guaranteed because
they can resume inside modified instructions; retain the old ROM/snapshot
identity separately. Pre-defect natural checkpoints replay correctly on the fix.

The 27-byte intermediate experiment is superseded and is not part of this fix.
Empty name fields are restored to defaults by the game's final confirmation,
so the original name-end handler remains unchanged.

This renderer validation alone does not establish a complete campaign playthrough.
Release-level campaign and controller acceptance are recorded in the archive
validation-summary.json; individual route coverage remains explicit there.
