fix(memory): return the Game Pak address pattern beyond the ROM chip

CPU and DMA reads past the supplied image returned Unmapped and stopped the
machine; a second game's boot code reads 0x09fe20f8 past a 16 MiB image. The
Game Pak shares data lines with the low address lines, so where no chip drives
the bus a read returns the halfword address, (A >> 1) & 0xffff, per lane
(GBATEK; mGBA uses the same pattern).

The chip is the image size rounded up to a power of two. Bytes between a
trimmed image's end and that boundary are unknown and stay diagnostic, as do
host reads and instruction fetches. Two truncation fixtures move into that gap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhfHfHEuzv2AUTd6erW1gU

crates/desktop/tests/rom_cli.rs

@@ -404,10 +404,15 @@ fn rtc_selection_is_explicit_and_does_not_modify_the_rom_file() {
     let path = fixture.rom(&rtc_setup());
     let original = fs::read(&path).unwrap();
     // Without the device, the GPIO store is an ordinary ignored ROM write. The read-back
-    // then reaches past this short image, which remains a diagnostic.
+    // lies beyond this short image's chip, so it returns the bus pattern (address / 2).
     let absent = run(&path, "100");
-    assert_eq!(absent.status.code(), Some(1));
-    assert!(stderr(&absent).contains("unmapped memory at 0x080000c8"));
+    assert!(absent.status.success(), "{}", stderr(&absent));
+    assert!(
+        stdout(&absent).contains("r2=0x00000064"),
+        "{}",
+        stdout(&absent)
+    );
+    assert!(!stdout(&absent).contains("RTC selected"));
     let selected = command()
         .arg("--rtc")
         .arg("--rom")