fix(riscv): implement sret/uret supervisor restore semantics

[carlosqwqqwq]

Route sret/uret to a dedicated supervisor restore path instead of the
machine-mode mret() implementation. Currently
Op::Sret | Op::Uret => self.mret() restores privilege from MPP, takes the
return PC from mepc, and rewrites the machine-mode stack bits
(MPP/MPIE/MIE), while never applying the supervisor semantics
(priv <- SPP, SIE <- SPIE, SPIE <- 1, SPP <- 0). Add a sepc CSR and
implement sret() accordingly.

Validation

• Existing probes R-010/R-011/R-012 (asserting the defective behavior) now
  fail, i.e. the defect is fixed.
• New regression tests v056/v056b verify the correct behavior: privilege
  restored from SPP, SIE set from SPIE, SPIE set to 1, SPP cleared, PC from
  sepc, and MPP/MPIE/MIE untouched.
• Full probe suite: 53 passed; the 6 failures are all expected
  (R-010/R-011/R-012 for this fix, R-023 for the segment-ff decode fix,
  R-017 obsolete, V-012 already adopted upstream).
• cargo test --lib passes.

Closes #289

[19h]

Thanks for the report and patch. I independently checked this against the current privileged architecture. #296 implements SRET restoration and privilege transitions, but deliberately rejects URET because the obsolete N-extension instruction is no longer defined by the current specification. The rollup includes your co-author credit and asks for your review. I’m closing this PR as superseded by #296.