fix: pmp sector walk hang on accesses at the top of the address space

[cphurley82]

Problem

pmp_check walks every 4-byte sector an access touches, with an address as the loop bound:

for(cur_addr = first_sector; cur_addr <= last_sector; cur_addr += sector_size)

• If the access touches the top sector of the address space, the step past last_sector wraps cur_addr to 0. That is still <= last_sector, so the loop never ends. The simulator hangs with no trap and no log.
• A zero-length access at address 0 has the same problem: addr + len - 1 underflows, so last_sector becomes the top sector.
• The walk only runs for enabled entries, so firmware hits this as soon as it programs any PMP entry and then touches the top of memory.

Fix

• Bound the walk on a 64-bit byte count from the start of the first sector, not on an address. A byte count can't wrap, whatever the address or len.
• Counting from the start of the first sector keeps the current behavior for misaligned accesses: a fetch at addr % 4 == 2 still checks both sectors it spans.

Tests

• New pmp-top-sector-test: programs one NA4 entry well away from the top, then does an M-mode load from the top 4-byte sector. Before the fix this hangs. With the fix, no entry matches and the load completes under the M-mode default.
• Added to the PMP Functional Tests job.
• Every riscv-sim step in that job now runs under timeout 60, and the job has a 10-minute limit. A hang like this one now fails CI instead of stalling it.