Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams

- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator
- Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000
- Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11)
- Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run)
  and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B'
- Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead
- Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy)
- Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md

Byte-identical ROM verified.

NES PowerPad Test Card (U)/copilot/reconstructed.lbl

@@ -1,3 +1,11 @@
+al 00F000 .VramWriteSourcePointerTable
+al 00E790 .SideATestPromptText
+al 00E732 .StatusMessageText
+al 00E6BF .SideAPanelButtonRow
+al 00E64C .SideAPressedButtonRow
+al 00E5B3 .PanelFrameTiles
+al 00E58A .PowerPadButtonLabelTiles
+al 00E54F .PowerPadSideAButtonGraphics
 al 00E548 .Label_E548
 al 00E53A .ClearScreen
 al 00E534 .ClearAPUNoise
@@ -7,6 +15,10 @@ al 00E514 .Label_E514
 al 00E52D .ProcessPadBitsDone
 al 00E509 .Label_E509
 al 00E4FA .ProcessPadBits
+al 00E4E3 .Player2ButtonIconStream
+al 00E4CC .Player1ButtonIconStream
+al 00E4C0 .Player2TileTable
+al 00E4B4 .Player1TileTable
 al 00E4B4 .PadBitTableLives
 al 00E4AA .LoadPatternTable7
 al 00E4A0 .LoadPatternTable6