sim: CRU reset-ladder model on MemBus (CruSim)

Models the RV1106 reset ladder + boot-mode register on the MemBus seam, so
flared's devmem::hard_reset ladder and the boot-mode -> MaskRom recovery
maneuver are testable entirely on the host. Bakes in the two hardware facts
that cost real bench time as regression tests:
  - the CRU global-reset register is 0xff3b0c08/0xfdb9; the magic at the wrong
    offset 0xff3a0614 (from other Rockchip SoCs) is a SILENT NO-OP here;
  - the boot-mode register 0xff020200 survives a warm reset (the mechanism that
    makes "set MaskRom, then reset" drop the SoC into BootROM download), and a
    power-on reset clears it.

6 tests (both rungs, pet, the wrong-offset no-op, MaskRom-survives-warm-reset,
POR-clears-request); the sim crate is 14/14 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

docs/architecture.md

@@ -60,7 +60,7 @@ supervisor logic runs in CI with no panel.
   let the boot-loaded-watchdog logic be validated before the flash that bricked a
   bench unit (though the *layout* fault — a load address in unreserved kernel RAM —
   is a target-config check, §5, not a sim property).
-- **Next:** a **CRU reset-ladder** model on `MemBus` (so `flared::devmem::hard_reset`'s
+- **`cru` — reset ladder.** Done. `CruSim` on `MemBus` (so `flared::devmem::hard_reset`'s
   ladder is host-tested against the known glb_srst_fst / DW-watchdog registers); an
   **NPU** load model behind the path seam; a **GPIO/relay** sysfs model; a **modbus
   device** model unifying the existing `mbsim.py` corpus into the same framework;