pureboot: W addresses a page, not a word in it

The in-page bits of a W address are dropped so the fill always walks from
the page base; the wire contract is one page of data for any address
inside it, on both the byte- and the word-addressed path. +2 B.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/pbtest.py

@@ -105,6 +105,17 @@ def main():
             # was never told about is a loader it would refuse to speak to.
             if live.version != pb.NEWEST_LOADER:
                 fail(f"loader reports pureboot {live.version}, the tool's newest is {pb.NEWEST_LOADER}")
+
+            # A W addressed inside a page rather than at its base must still
+            # consume exactly one page and prompt. The loader's own slot is
+            # the target — it is drained and never programmed — and the
+            # payload is erased-state bytes, so the probe can disturb neither
+            # the image nor the page buffer it leaves behind.
+            wire = wire_base + 1
+            port.write(bytes((ord("W"), wire & 0xFF, wire >> 8)) + b"\xff" * page)
+            if port.read_exact(1, 5.0) != pb.PROMPT:
+                fail("unaligned W did not return to the prompt")
+
             loader.run_application()
             banner = port.read_exact(3, 5.0)
             if banner != b"APP":