tests: add dedicated test cases for -bios builtin SBI mode

[Lfan-ke]

Background

PR #40 introduced -bios builtin mode, which boots kernels directly
in S-mode with a host-side SBI backend. Currently the test suite only
ensures the feature compiles and that existing tests still pass
(bios_builtin: false is threaded through every MachineOpts
literal). There are no tests that exercise the builtin-mode code
paths themselves.

Goal

Add dedicated tests that cover the SbiBackend implementation and
boot_builtin() entry state, so that regressions in either are
caught before merge.

Proposed Test Cases

1. Boot entry state (boot_builtin)

• CPU0 starts in S-mode, not M-mode
• a0 = 0 (hartid), a1 = valid in-RAM FDT address
• mideleg = 0x0222, medeleg = 0xB1FF (match the values set in
  boot_builtin)
• mie has MTIE set (bit 7)
• PMP entry 0 grants full R/W/X access (pmpcfg[0] = 0x1F,
  pmpaddr[0] = u64::MAX)

2. SBI console (EID 0x01 / 0x02)

• CONSOLE_PUTCHAR: write a known byte via SbiBackend::handle_call
  and verify it appears in the UART TX buffer
• CONSOLE_GETCHAR: inject a byte into the UART RX FIFO, call
  handle_call, verify a0 returns the correct byte; verify a0
  = -1 when RX is empty

3. SBI timer (EID 0x00 / TIME)

• SET_TIMER: program a future mtimecmp value and verify STIP
  (bit 5 of mip) is asserted when mtime ≥ mtimecmp
• Verify STIP is cleared and mtimecmp is updated after a second
  SET_TIMER call (no spurious interrupt from the previous deadline)

4. SBI system reset (EID SRST)

• SYSTEM_RESET (fid = 0): verify the shutdown callback fires and
  the VM stops

5. SBI base extension (EID 0x10)

• GET_SBI_SPEC_VERSION returns 0x0200_0000 (v2.0)
• PROBE_EXTENSION returns 1 for each supported EID and 0 for an
  arbitrary unsupported EID

6. Minimal integration test (stretch goal)

• A small hand-assembled RISC-V S-mode binary that makes a sequence
  of SBI calls and writes a known exit code via SiFive Test
• Run through the full machine cycle with -bios builtin and assert
  the expected ShutdownReason

Implementation Notes

• Boot-state tests can go in tests/src/hw_ref_machine.rs
  alongside the existing test_boot_sets_cpu_state tests
• SBI unit tests belong in a new tests/src/builtin_sbi.rs
  module; they can construct an SbiBackend directly and call
  handle_call with a synthetic RiscvCpu, keeping them fast and
  deterministic without spinning up the full machine cycle
• The test harness will need:
  • A helper to build a minimal RiscvCpu with controlled register
    state (a0–a7 set to EID / FID / args)
  • Access to Uart16550::read_rbr_nonblocking and the TX path for
    console tests
  • Aclint::read_mtime / set_mtimecmp for timer tests