Fix/ghost hack crash usamune

[hugou74130]

Fixes #4

Problem

The ghost hack's extended-RAM region lived at 0x80400000, which collides with ROM hacks that use expansion-pak memory. On Usamune 1.93 U, enabling the ghost hack caused stack-overflow crashes in Mupen as soon as Mario performed certain animations (backflip, long jump, sideflip, triple jump, dive...).

Changes

• Relocate the whole ghost hack region from 0x80400000 to 0x80600000, for both US and JP:
  • rebuilt/updated payloads and inject addresses in GhostHackUS.hck and GhostHackJP.hck, plus the area_update_objects hook (jal 0x80608000)
  • updated the asm sources (ghost_loop.asm, ghost_hack_US.asm / ghost_hack_JP.asm, additional hacks.txt) so they match the shipped payloads
• Centralize the region layout in code: GHOST_REGION_BASE in GhostTab.cs with named offsets (NUM_GHOSTS_ADDR, FIRST_GHOST_POINTER_ADDR, DISABLE_REQUEST_ADDR, GHOST_CODE_ADDR) replacing the scattered hex literals; ColoredHats.cs derives from it. The asm side mirrors this with a single GhostBaseHi symbol (the old ExtendedRAMStartHi alias is removed) whose comment lists every place that must stay in sync.
• Swap the "Move GFX Pool" defaults to 0x80400000/0x80500000 (the freed former ghost region), since the previous defaults (0x80600000/0x80700000) would now overlap the relocated ghost region.

Testing

Tested in the emulator with the ghost hack enabled and ghosts rendering: US vanilla, JP vanilla, Usamune 1.93 U and one other ROM hack — no crashes, including the animations that previously crashed Usamune.

The JP payload was additionally byte-verified against the US one: after relocation the two only differ at the version-specific addresses (gMarioObject, global timer, set_mario_animation / alloc_display_list targets), matching the equ tables in the asm sources.