callee-save floating point registers break frame pointer

When callee-save floating point registers are saved in a function prologue, the emitted code gets confused about where the frame pointer is. Specifically, it moves csp into c29 when csp is pointing into the saved floating point register area. See https://cheri-compiler-explorer.cl.cam.ac.uk/z/dvfM9s for an example.