Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams

- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator
- Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000
- Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11)
- Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run)
  and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B'
- Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead
- Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy)
- Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md

Byte-identical ROM verified.

_wip/MUSCLE (U)/copilot/zero_page_ranges.tsv

@@ -0,0 +1,7 @@
+# MUSCLE (U) reused zero-page bytes - Pass 3
+# Zero page $14/$15 is the 16-bit block counter for the compressed-VRAM transfer path and
+# the collision-bit accumulator for the overlap test. locals.inc names both roles; this
+# file applies the counter name only inside AdvanceCountWord and the two block-count
+# set-ups, so the same byte is not mislabelled at every site.
+# kind<TAB>start<TAB>end<TAB>old<TAB>new
+zprange	0xACD7	0xACE2	Zp15	StreamBlockCountHi