Balloon Fight (JU) Pass 1: replace final .incbin spans with explicit classified bytes

Balloon Fight's Pass 1 was already complete and hand-done to a higher standard
than a static tracer: 5,303 instructions / 11,260 code bytes, versus 5,277 /
11,202 from the complete-opcode tracer. The 166 bytes the tracer finds 'missing'
are genuinely data (command scripts at $D437/$D45A referenced by
'lda $D45A,y', the $C3B5 pointer table, the arithmetic table at $FBCA), so no
code was added.

The real remaining Pass 1 gap was the repo rule that no ROM byte stays hidden
in an .incbin. Two spans converted:
- $F4C5-$F4FF (59 bytes) -> TrailingFillBeforeApuTables: $FF padding after
  the sound-init RTS at $F4C4, unreached
- $F5FC-$F5FF (4 bytes)  -> SoundEngineTailBytes: unreachable filler between
  the sound engine's final JMP ($F5F9) and ApuPeriodTable ($F600)

Verified: symbol layout restored (ApuPeriodTable $F600, UpdateAudioFrame $FFF7),
both new blocks byte-exact against the ROM, no .incbin remains.
Byte-identical ROM verified.

Balloon Fight (JU)/copilot/prg.s

@@ -7389,7 +7389,18 @@ InitializeGameplayGlobals:
     sta $99                                   ; $34C2: 85 99
     rts                                       ; $34C4: 60
 
-.incbin "prg.bin", $34C5, $003B
+; $F4C5-$F4FF - trailing $FF padding after the sound-init routine's RTS at $F4C4.
+; Pass 1: emitted as explicit classified bytes so no ROM byte stays hidden in an
+; .incbin. Unreached padding, never executed.
+TrailingFillBeforeApuTables:
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34C5: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34CD: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34D5: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34DD: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34E5: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34ED: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF   ; $34F5: FF FF FF FF FF FF FF FF
+    .byte $FF, $FF, $FF                            ; $34FD: FF FF FF
 
 ; UpdateSoundEngine
 ; Purpose: invoke the sound-effect/music sequencer for the current frame.
@@ -7558,7 +7569,12 @@ Label_F5E1:
 Label_F5F9:
     jmp Label_F5B2                            ; $35F9: 4C B2 F5
 
-.incbin "prg.bin", $35FC, $0004
+; $F5FC-$F5FF - four unreached bytes between the sound engine's final JMP
+; ($F5F9) and ApuPeriodTable ($F600). Left as data: the preceding instruction
+; is an unconditional JMP so control never falls through here, and the bytes do
+; not form a coherent instruction sequence.
+SoundEngineTailBytes:
+    .byte $16, $FF, $10, $C5                         ; $35FC: 16 FF 10 C5
 
 ; Interleaved APU timer high/low bytes; aliases below preserve the original odd/even indexed accesses.
 ApuPeriodTable:

Balloon Fight (JU)/copilot/reconstructed.lbl

@@ -103,6 +103,7 @@ al 00F687 .SelectPulse2Offset
 al 00F691 .Label_F691
 al 00F683 .SelectSoundChannelOffset
 al 00F600 .ApuPeriodTable
+al 00F5FC .SoundEngineTailBytes
 al 00F5F9 .Label_F5F9
 al 00F5D9 .Label_F5D9
 al 00F5CE .Label_F5CE
@@ -128,6 +129,7 @@ al 00F51B .Label_F51B
 al 00F504 .ProcessSoundChannels
 al 00F503 .Label_F503
 al 00F500 .UpdateSoundEngine
+al 00F4C5 .TrailingFillBeforeApuTables
 al 00F4A5 .InitializeGameplayGlobals
 al 00F4A2 .Label_F4A2
 al 00F489 .Label_F489