fix(fetch): report the faulting instruction halfword in TVAL

[murdoa]

Stacked on #9.

Bug

With compressed instructions enabled, a 32-bit instruction can start two bytes before a page boundary. Its first halfword may be readable while fetching the second halfword faults.

For example, an instruction beginning at 0x0ffe whose second halfword faults at 0x1000 should report:

	EPC	TVAL
Current behavior	0x0ffe	0x0ffe
Expected	0x0ffe	0x1000

EPC identifies the instruction to restart. When reporting a nonzero TVAL for an instruction access/page fault, RISC-V requires the address of the portion that faulted. Reporting the instruction start instead points a page-fault handler at the already-mapped page rather than the missing next page.

The fetch unit retains the instruction-start PC, but does not retain a separate fault address. Both in-order executors consequently use the instruction start for both EPC and TVAL.

Fix

• Latch a separate fault address when accepting a failed fetch: the starting PC for the first read, or PC + 2 for the straddle's second read.
• Hold that address with the delivered fetch fault through decode, and pass it to both static and microcoded execution.
• Use it for instruction access and page faults, without changing EPC or cause selection. The executor input is optional, preserving existing behavior for other callers.

This covers cached and uncached in-order cores. OoO and the separate pipelined fetch interface are unchanged.

Validation

52 new core cases cover RV32/RV64 access faults, Sv39 page faults, ERR-only/ACK+ERR, and both executors/cache modes. They check EPC/TVAL and architectural trap CSRs, destination preservation, and handler recovery. First-half failures and successful straddles are controls against incorrectly adding two to every fetch address.

All 20 second-halfword cases reproduce the wrong TVAL on the baseline and pass with the patch. The other 32 new cases and 170 existing targeted cases pass on both: 202 pass / 20 fail → 222 pass / 0 fail.