Balloon Fight (JU) Pass 1: replace final .incbin spans with explicit classified bytes

Balloon Fight's Pass 1 was already complete and hand-done to a higher standard
than a static tracer: 5,303 instructions / 11,260 code bytes, versus 5,277 /
11,202 from the complete-opcode tracer. The 166 bytes the tracer finds 'missing'
are genuinely data (command scripts at $D437/$D45A referenced by
'lda $D45A,y', the $C3B5 pointer table, the arithmetic table at $FBCA), so no
code was added.

The real remaining Pass 1 gap was the repo rule that no ROM byte stays hidden
in an .incbin. Two spans converted:
- $F4C5-$F4FF (59 bytes) -> TrailingFillBeforeApuTables: $FF padding after
  the sound-init RTS at $F4C4, unreached
- $F5FC-$F5FF (4 bytes)  -> SoundEngineTailBytes: unreachable filler between
  the sound engine's final JMP ($F5F9) and ApuPeriodTable ($F600)

Verified: symbol layout restored (ApuPeriodTable $F600, UpdateAudioFrame $FFF7),
both new blocks byte-exact against the ROM, no .incbin remains.
Byte-identical ROM verified.

Balloon Fight (JU)/copilot/reconstructed.lbl

@@ -103,6 +103,7 @@ al 00F687 .SelectPulse2Offset
 al 00F691 .Label_F691
 al 00F683 .SelectSoundChannelOffset
 al 00F600 .ApuPeriodTable
+al 00F5FC .SoundEngineTailBytes
 al 00F5F9 .Label_F5F9
 al 00F5D9 .Label_F5D9
 al 00F5CE .Label_F5CE
@@ -128,6 +129,7 @@ al 00F51B .Label_F51B
 al 00F504 .ProcessSoundChannels
 al 00F503 .Label_F503
 al 00F500 .UpdateSoundEngine
+al 00F4C5 .TrailingFillBeforeApuTables
 al 00F4A5 .InitializeGameplayGlobals
 al 00F4A2 .Label_F4A2
 al 00F489 .Label_F489