fix(riscv): reject vmadc/vmsbc mask results overlapping sources

[carlosqwqqwq]

Closes #269

Summary

The carry/borrow-producing instructions vmadc.vv/vmadc.vx/vmadc.vi/vmsbc.vv/vmsbc.vx write a single mask-result register (EEW=1) while reading SEW-width register groups from vs2 and vs1. A destination that falls inside a source register group is a reserved encoding unless it names the lowest-numbered register of that group. The affected Vmadc/Vmsbc execution path performed no overlap check, so reserved encodings executed and wrote the mask result into a register that was simultaneously read as part of a source group. QEMU raises SIGILL for the same encodings.

The fix adds the mask-result overlap rule to the vector legality checks: the destination may overlap a source group only when it names the lowest-numbered register of that group. vs2 is checked in every form; rs1 is checked only in the vv form, because the vx form reads a scalar from rs1 and the vi form reads a 5-bit immediate — neither may be treated as a vector register number.

Validation

• The change is verified against the current master source layout.

No new upstream test files are added; this is a source-only change.

[19h]

Thanks for the report and patch. I independently reproduced and validated this issue, then reimplemented the accepted mask-result overlap behavior with source snapshots and expanded direct/SMIR tests in #296. That rollup includes your co-author credit and asks for your review. I’m closing this PR as superseded by #296.