RESTART.

TODO:
- [x] add support for toggling literal types, ala `o` in IDA. (decimal to hex to
      reference etc.)
      -> `o` / `O` on either code view cycle the literal under the cursor;
         named formats (hex/dec/oct/bin/char/offset/stack/default) via the
         command palette, the `opfmt` RPC verb and `drive fmt`.
      -> listing: IDA's operand types (ida_bytes.op_hex/op_dec/... +
         op_plain_offset). pseudocode: Hex-Rays' own per-(ea,opnum) numforms,
         which are a SEPARATE set — the listing's format doesn't reach it.
      -> the ring only offers stops that change what you see: no `char` unless
         the value prints as one, no `offset` unless the target is already
         named (making one invents a dummy name that cycling past does NOT
         remove). Explicit requests still convert anything mapped.
      -> `B` now cycles the opcode-bytes column (it used to be `o`).
      -> the literal the cursor is on is MARKED, and that mark is what changes:
         operand extents come from IDA's own COLOR_OPND markers on the line
         (free — the line is generated anyway, and they agree with
         print_operand exactly), pseudocode literals from one pc_nums call per
         decompile. Cursor on a register: refused, naming the operand that has
         a format, rather than reformatting a different one behind the mark.
      -> the cursor follows its literal across the edit (48 <-> 0x30 reflows
         the line; holding the column put the next press on a neighbour).

fixed on the way (pre-existing, both made edits happen off screen):
- `cursor_on` searched from row 0 of the whole segment and never scrolled, so a
  driver's `word=` edit landed in an unrelated function, invisibly, while
  reporting success. Now searches from the viewport (wrapping) and scrolls.
- the `cursor` verb didn't scroll either; both go through rpc.place_cursor.

known, NOT mine, still open:
- tests/test_scenarios.py: `split_view`'s "a multi-instruction C line bands a
  region" fails when asm_highlight runs immediately before it (`--only
  asm_highlight,split_view`). Reproduced on a clean tree at 5f5c2ba, so it is an
  order-dependent leak between scenarios, not a code regression.
- `drive go 0x24ad` can raise TimeoutError while the cursor IS on the target
  ("did not land within 20.0s (still at main @ 0x24ad)") — the goto predicate
  resolves to the function entry, so a jump WITHIN the current function never
  satisfies it.
- enums? im too lazy to use them generally but hey we have robots
  -> the groundwork is in: op_format already READS an enum-formatted operand
     (and refuses to clobber it silently — it warns, because the nibble doesn't
     record WHICH enum and we can't put it back). What's missing is
     op_enum(ea, n, id, serial) plus a picker for the enum + a way to make one.