Joystick input simulation via BMP (0xa2)

## Summary

Set joystick port values programmatically from Ghidra to simulate player input. Useful for advancing a game to a specific state (navigating menus, triggering game events, reaching a level) to set up the state you want to analyse.

---

## BMP protocol details

**Command:** `CMD_JOYPORT_SET = 0xA2`

Request payload:
```
port_id (2 LE) — 0 = port 1 (CIA2 $DD00 bits 6-7 + CIA1 $DC00), 1 = port 2
value (1) — joystick bits: bit0=up, bit1=down, bit2=left, bit3=right, bit4=fire
(active low in hardware, but BMP takes active-high: 1=pressed)
```

Response: standard ACK.

To release all directions after sending input, send a follow-up with `value=0`.

---

## Implementation plan

### 1. `util.py`

```python
CMD_JOYPORT_SET = 0xA2

JOY_UP = 0x01
JOY_DOWN = 0x02
JOY_LEFT = 0x04
JOY_RIGHT = 0x08
JOY_FIRE = 0x10

def joyport_set(self, port: int, value: int):
"""Set joystick state. port: 0=port1, 1=port2. value: OR of JOY_* constants."""
self._command(CMD_JOYPORT_SET, struct.pack('