fix: preserve ECX in usercall trampoline for thiscall MapColor hook

WA's ProcessSprite loops calling PaletteContext__MapColor without
re-setting ECX between iterations, relying on the original function
preserving ECX (it only reads [ECX+offset]). Our trampoline's cdecl
call clobbered ECX, causing garbage reads on 2nd+ iteration and
rendering all sprites/text white.

Add a `preserve_ecx` variant to usercall_trampoline! that saves and
restores ECX across the cdecl impl call.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/openwa-wormkit/src/hook.rs

@@ -57,6 +57,29 @@ macro_rules! usercall_trampoline {
         }
     };
 
+    // 1 register arg (ECX), 1 stack param, ret N — preserves ECX across call.
+    // Callers of thiscall functions may rely on ECX being preserved even though
+    // the ABI says it's caller-saved (MSVC often generates loops that don't
+    // re-set ECX between calls if the callee happens to preserve it).
+    (fn $name:ident; impl_fn = $impl:path; reg = ecx;
+     stack_params = 1; ret_bytes = $ret:literal; preserve_ecx) => {
+        #[unsafe(naked)]
+        unsafe extern "C" fn $name() {
+            core::arch::naked_asm!(
+                "push edx",
+                "push ecx",                // save ECX for restoration
+                "push [esp+12]",           // stack param (shifted +4 by extra push)
+                "push ecx",               // cdecl arg (ECX still valid here)
+                "call {impl_fn}",
+                "add esp, 8",
+                "pop ecx",                // restore ECX
+                "pop edx",
+                concat!("ret ", $ret),
+                impl_fn = sym $impl,
+            );
+        }
+    };
+
     // 1 register arg, 3 stack params, ret N
     (fn $name:ident; impl_fn = $impl:path; reg = $reg:ident;
      stack_params = 3; ret_bytes = $ret:literal) => {

crates/openwa-wormkit/src/replacements/sprite.rs

@@ -48,7 +48,7 @@ usercall_trampoline!(fn trampoline_process_sprite; impl_fn = process_sprite_impl
 // ---------------------------------------------------------------------------
 
 usercall_trampoline!(fn trampoline_palette_map_color; impl_fn = palette_map_color_impl;
-    reg = ecx; stack_params = 1; ret_bytes = "0x4");
+    reg = ecx; stack_params = 1; ret_bytes = "0x4"; preserve_ecx);
 
 unsafe extern "cdecl" fn palette_map_color_impl(palette_ctx: u32, rgb: u32) -> u32 {
     let ctx = palette_ctx as *mut openwa_core::render::palette::PaletteContext;