Audit comment standardization + new tool (2026-10-19)

Standardized all 18 top-level projects to canonical audit comment format:
  ; CPU:$XXXX PRG:XXXX AA BB

Changes per project:
- CIRCUS: fixed 4,427 comments (CPU:XXXX -> CPU:$XXXX)
- Excitebike (JU): fixed 48 double-semicolon comments (; state $XX  ; CPU:...)
- 9 projects received canonical comments via new audit_comment_tool.py:
  Balloon Fight, Baseball, Bomberman, Burger Time, Clu Clu Land,
  Defender 2, Donkey Kong 3, Donkey Kong Jr., Tennis

New tool: _tools/audit_comment_tool.py
- Uses nesdis.py tracer as ground truth for instruction bytes/addresses
- Parses source while tracking PRG offset, emits canonical comments
- Handles .byte/.word/.dword directives, instruction comments (short format)
- Carves PRG from rom.nes when prg.bin missing

Documentation updates:
- TODO.md: Updated current state, item 3 (tool built), repo conventions, tool list
- AGENTS.md: Added audit_comment_tool.py to _tools/, updated audit convention

Verification: verify_pass1.py reports all 18 projects byte-identical with 'canoni' format.

AGENTS.md

@@ -10,7 +10,7 @@ Thirty-six AI-generated disassemblies of NES ROMs: 17 promoted to top-level fold
 - Root `OVERVIEW.md` is the index: vectors, build fixes, and summary for all 36 projects. **Keep it in sync** when a project changes — its DK Jr. entries drifted badly before being corrected, and its vector column later turned out to have five rows wrong from copy-paste duplication.
 - `TODO.md` is the handoff: open work per project, plus the gotchas that cost real time. Read it before starting anything non-trivial.
 - `PROMPTS.md` is the workflow contract. `default_project.tar.gz` is the empty-project skeleton (prg.s, symbols.inc, linker.cfg, Makefile, locals.inc). `_ROMS/` is the master ROM store.
-- `_tools/`: `nesdis.py` (Pass 1 tracer), `pass2.py` and `bytecode_dis.py` (Pass 2/3 emitters), `trace_stage_payload.py` (py65-based runtime tracer), `cdl_reclass.py` (Mesen-CDL-driven code/data split fix), `verify_pass1.py` (rebuild + re-trace check across all projects), `splitnes.py`, `chr2gif.py`.
+- `_tools/`: `nesdis.py` (Pass 1 tracer), `pass2.py` and `bytecode_dis.py` (Pass 2/3 emitters), `trace_stage_payload.py` (py65-based runtime tracer), `cdl_reclass.py` (Mesen-CDL-driven code/data split fix), `verify_pass1.py` (rebuild + re-trace check across all projects), `audit_comment_tool.py` (adds canonical audit comments using tracer as ground truth), `splitnes.py`, `chr2gif.py`.
 
 ## Commands
 
@@ -35,7 +35,7 @@ python3 _tools/verify_pass1.py  # rebuilds and re-traces every project
 
 ## Irreversible conventions (do not "clean up" past these)
 
-- Every instruction carries a trailing audit comment with its CPU address, PRG offset and exact emitted bytes. The dominant spelling is `; CPU:$C123 PRG:0123  AD 21 03` — 8 of the 17 top-level projects use exactly it — but **six other spellings are in use across the repo** and 1,013 of Excitebike's 5,376 instruction lines carry no comment at all (`_tools/verify_pass1.py` reports the split; it needs `re.M` on the canonical pattern, fixed 2026-10-18, or it misreports every project). This is the byte-identity audit trail — preserve whatever spelling a file uses even while renaming labels or restructuring files. See the TODO in root `OVERVIEW.md` for closing the gap.
+- Every instruction carries a trailing audit comment with its CPU address, PRG offset and exact emitted bytes. **The canonical format is `; CPU:$C123 PRG:0123  AD 21 03` — all 18 top-level projects now use this exact format** (standardized 2026-10-19). This is the byte-identity audit trail — preserve it even while renaming labels or restructuring files. The earlier gap (6 variants, 1,013 uncommented lines in Excitebike) was closed 2026-10-19 via `_tools/audit_comment_tool.py`.
 - Unreached/unresolved bytes stay as data (`Label_/Data/` `.byte` or `.incbin` blocks with ROM provenance), never deleted or reformatted.
 - Routine headers follow the template in `prg.s`: global + local description, parameters, returns, clobbers.
 - Two separate symbol files: `symbols.inc` = NES hardware constants only; `locals.inc` = zero-page and forward references. Unresolved zero-page bytes keep neutral `ZpXX` names rather than speculative names. Proven semantic names may sit *beside* the generated `ZpXX` entries as aliases.