feat(cache): place scalar Sv39 L1 caches after translation

[murdoa]

Problem

The frontend D-cache uses a virtual-address DRAM threshold to decide cacheability. Under Sv39, a high virtual address can map to a physical device. Two LW instructions targeting an explicitly described device at 0x200000 produce an 8-byte line refill at 0x200000/0x200008, rather than two requested 4-byte device reads.

Changes

• Place L1 after translation and page-permission checks for non-H, single-issue, non-speculative in-order Sv39 configurations with an XLEN-matched bus and no configured PMP/PBMT. Use full physical tags.
• Allocate only when a complete, page-bounded line fits explicit readable, idempotent RAM supporting the refill beat width; I-cache allocation also requires executable RAM. Devices, unknown regions and partial lines bypass. Platforms must describe RAM PMAs to enable allocation on this path.
• Carry actual read sizes and byte addresses through this path, including FP and atomic reads. Preserve lane-zero results so bypass does not truncate 64-bit loads or lose upper-word lanes.
• Bypass page walks, invalidate cached PTE data on walker writes/A-D updates, and retain accepted bus ownership across cache flushes.
• Reactivate the existing skipped kernel-MMIO regression. Keep legacy profiles and Harbor geometry limits unchanged; no dependency/tag-RAM, board or timing changes. Cached misaligned loads remain disabled.

Validation

• 289 identical paired cases: 267 pass / 22 assertions upstream → 288 pass / 1 unchanged assertion. Every baseline pass is preserved. Counts include policy checks and existing fixture assumptions, not 22 distinct architectural defects.
• 46 additional component/configuration checks pass, including six configuration guards. Total: 334 pass, one unchanged assertion.
• Coverage includes exact SEL/lane/width behavior, aliases and ASID changes, warm-line permissions, walker coherence, refill faults and exactly-once stores through flush.
• Package analysis is identical (21 warnings, 15 infos); all 11 changed Dart files are formatted.
• Fourteen configurations emit SystemVerilog. Ten legacy-profile outputs are identical after excluding only the generation-time comment. No synthesis, area or timing claims.

The remaining existing test expects stale cached data after an alias store; both versions instead return the stored value. The existing transient-IRQ positive control also changes outcome with cache timing; this PR does not claim an interrupt fix.