feat: Hermite resampling, sprite shift registers, controller open bus

#3 audio.rs: replace linear interpolation with Catmull-Rom Hermite cubic.
  Stores prev_sample as p0 control point; m1=(p2-p0)/2, m2=(p2-p1)/2
  tangents give continuous first derivative across batch boundaries.

#4 ppu: add per-slot sprite shift registers (spr_shift_lo/hi, spr_x_counter,
  spr_attr_latch). load_sprite_shifters fetches pattern bytes with h-flip at
  dot 1 of each visible scanline. sprite_pixel_from_shifters replaces the
  per-pixel OAM scan; sprite-0 hit detection integrated into the shifter path.

#5 joypad.rs: format_controller_read now preserves bits 1-5,7 as open bus
  (!0x41 mask) instead of zeroing bits 1-4, matching NES hardware behaviour.

src/native_core/bus/joypad.rs

@@ -67,8 +67,11 @@ impl NativeBus {
     }
 
     fn format_controller_read(&self, bit: u8) -> u8 {
-        // Controller reads expose serial data in bit0, keep bit6 high, and
-        // preserve open-bus upper bits.
-        (self.cpu_open_bus & 0xE0) | 0x40 | (bit & 1)
+        // The NES controller port drives only bit 0 (serial data); bit 6 is
+        // held high by a pull-up on the expansion connector.  All other bits
+        // (1-5, 7) float and retain whatever is currently on the CPU data bus
+        // (open bus).  !0x41 clears bits 6 and 0 so we can OR in their
+        // canonical values without corrupting any open-bus bits.
+        (self.cpu_open_bus & !0x41u8) | 0x40 | (bit & 1)
     }
 }