fix: preserve nonvolatile registers across native LoadSeg handoff

[benletchford]

Summary

• record the Toolbox nonvolatile register set when entering a native patched trap
• restore D3-D7 and A2-A6 when an auto-pop old _LoadSeg hands execution back to the original patched jump-table entry
• extend the MPW regression test to prove nonvolatile registers are restored while D0 and A0 remain eligible for handler results

Root cause

The native _LoadSeg path deliberately abandons the patch handler's stack frame when it restores the original caller stack, as fixed by #358. That also bypasses the handler's cleanup code. Systemless did not restore the nonvolatile registers that cleanup would have restored, so an internal handler A6 could reach the original caller and make a later UNLK consume an invalid return address.

Inside Macintosh: Operating System Utilities (1994), chapter 8, permits Toolbox routines to alter D0-D2, A0, and A1, which makes D3-D7 and A2-A6 the preserved set modeled here.

Validation

• cargo fmt --all -- --check
• cargo test --lib (2949 passed, 3 ignored)
• public 68K reproducer crosses the former Invalid PC $98FE03FF checkpoint and reaches an application-controlled ExitToShell

Closes #602.