Add question-oriented emulator C++ probe

[andrewboudreau]

Summary

• add tools/trace/cpp_probe.py, a question-oriented runtime probe for readable-C++ reconstruction
• resolve matched and near-miss symbols with ROM-backed overlay canaries and ARM/Thumb breakpoint metadata
• infer reconstructed classes/fields, capture the same object at entry and return, and report callers, writes, values, return registers, and module-qualified vtable candidates
• add focused regression coverage plus a portable CPP_PROBE_JOB.md handoff for assigning real emulator investigations
• document the workflow in the trace README and type-reconstruction runbook

Why

Decompiler output establishes the instruction stream, but it is awkward for runtime-observable questions such as which concrete object reaches a method, which fields change, and what values a candidate timer or fixed-point field takes in gameplay. This adds a narrow evidence-gathering layer while keeping byte matching and relocation verification as the source gates.

Validation

• python -m pytest tools/test_trace_cpp_probe.py: 11 passed
• python -m pytest tools: 277 passed, 3 skipped
• python tools/rombuild.py -j 16 --no-rom: 10,813/10,813 reproducing, 106/106 modules exact
• resolve-only smoke tests for an arm9 method and an overlay method
• pre-push port_refcheck: 393 references checked, all resolved
• duplicate-source check: clean

Live emulator validation

An isolated melonDS 1.1 session captured Fader::AdvanceInterp for 900 entry/return pairs with a ROM-clean canary, no overlay rejects, and one stable object/vtable. The observed idle endpoint held currInterp=0, speed=-1.0, returned true, and did not write the object. A separate setter probe recorded zero hits on the exercised path; that is retained as a negative observation, not interpreted as proof that the setter is unused.

The live report exposed and now covers an adjacent-function bug in vtable slot naming: concrete function pointers resolve at their exact address, while only link-register caller resolution subtracts the ARM/Thumb call width. Reports also label classes recovered from slot methods as method-owner hints rather than concrete-type proof, and summarize entry r0-r3 values for argument questions.

[tangos-validator]

✅ PR validation — Passed

noverify: no source/build-data changes in this PR

_{Each changed src/*.c|*.cpp is compiled and its relocated bytes compared to the binary data on a private build box. Passing requires every changed file to reproduce the ROM byte-for-byte with correct relocation targets — this catches WRONG-DEST relocations and non-reproducing near-misses that ledger-scoped linkcheck skips.}