spec(t27f): reel host entry points so a wasm host can draw stills #9980

Problem

specs/t27f/reel.t27 (#9966, issue #9965) computes the reel's cell positions, camera, screen mapping and cell style, but nothing outside the compiler can run those bodies. gen-js emits constants only, and a wasm export can carry only scalars, so a host such as the t27 MCP server cannot draw a still without re-implementing the math by hand.

Ask

Add scalar host entry points to reel.t27:

• corner_dx and corner_dy: the six hexagon corners;
• demo_frames, demo_scene_at and demo_still: the demo reel's frame clock;
• demo_sx, demo_sy, demo_r, demo_corner_sx and demo_corner_sy: camera composed with the screen mapping.

With these, a host only draws what the entry points return.

Done when

• The entry points have test blocks in the spec.
• Negative controls are killed.
• gHashTag/t27-mcp t27f_view draws the demo still from a wasm build of the Zig output.

Boundary

specs/t27f/reel.t27 only. No compiler changes, no generated files.