sim: CRU reset-ladder model on MemBus (CruSim)

Models the RV1106 reset ladder + boot-mode register on the MemBus seam, so
flared's devmem::hard_reset ladder and the boot-mode -> MaskRom recovery
maneuver are testable entirely on the host. Bakes in the two hardware facts
that cost real bench time as regression tests:
  - the CRU global-reset register is 0xff3b0c08/0xfdb9; the magic at the wrong
    offset 0xff3a0614 (from other Rockchip SoCs) is a SILENT NO-OP here;
  - the boot-mode register 0xff020200 survives a warm reset (the mechanism that
    makes "set MaskRom, then reset" drop the SoC into BootROM download), and a
    power-on reset clears it.

6 tests (both rungs, pet, the wrong-offset no-op, MaskRom-survives-warm-reset,
POR-clears-request); the sim crate is 14/14 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

sim/src/lib.rs

@@ -9,8 +9,10 @@
 //! is an in-memory word map; on the device, flared's `devmem.rs` implements the same
 //! trait over `/dev/mem`, so the same code runs against either. See the repo README.
 
+pub mod cru;
 pub mod hpmcu;
 pub mod membus;
 
+pub use cru::{BootMode, CruSim, ResetCause};
 pub use hpmcu::HpmcuSim;
 pub use membus::{MemBus, SimBus};