Fix mtinst zeroing on traps

[124107157-KV]

• I have searched for similar pull requests
• I am a human engaging in an interpersonal interaction. During this interaction, my words are my own and are not generated. If relevant, I provide links to my sources.

Why is this PR needed?

In a normal non-SPIKE_TANDEM build, the mtinst update logic depends on ariane_pkg::ZERO_TVAL before checking whether the trap cause requires mtinst to be zero.

Since ZERO_TVAL is disabled in a normal build, a virtual-instruction exception can write ex_i.tinst into mtinst instead of zero. The same condition also affects interrupts, for which mtinst must always be zero.

This fixes #3496.

What does this PR change?

• Removes the ZERO_TVAL dependency from the mtinst zeroing condition.
• Keeps mtinst zeroing for the exception cases where zero is required.
• Keeps the interrupt cause check so all interrupts write zero to mtinst.
• Does not unconditionally zero INSTR_GUEST_PAGE_FAULT, preserving MMU-generated VS-stage page-walk pseudoinstructions when required.
• Adds a directed RV64 regression for the virtual-instruction case.
• Adds a directed RV64 regression for the interrupt case.
• Adds both regressions to testlist_issues.yaml and issue-tests.sh.
• Explicitly runs the regressions without SPIKE_TANDEM so ZERO_TVAL cannot mask the bug.

Verification

Both directed regressions were run with:

target: cv64a6_imafdch_sv39
simulator: veri-testharness
SPIKE_TANDEM: unset

Virtual-instruction regression:

Before fix: FAILED (tohost = 2)
After fix: SUCCESS (tohost = 0)

Interrupt regression:

Before fix: FAILED (tohost = 2)
After fix: SUCCESS (tohost = 0)

In both failing runs, tohost = 2 corresponds to observing the expected trap or interrupt cause with a non-zero mtinst value.

Additional checks:

• git diff --check
• bash -n verif/regress/issue-tests.sh
• verible-verilog-format v0.0-4084-gf3e4d98b
• full-file Verible formatting check for core/csr_regfile.sv

Limitations

This change is intentionally limited to mtinst.

The similar htinst expression is not modified because it is outside the reproducer and scope of issue #3496.