fix(kg): byte-reverse d_reg before sha3_chain to match FIPS 203

RTL was feeding d bytes in reversed order to SHA3-512,
causing G(d) to produce wrong rho/sigma. Fix: add d_rev
wire with byte reversal, connect to sha3_chain_top_shared.

sync_rtl/top/mlkem_top.v

@@ -113,6 +113,13 @@ module mlkem_top #(
     reg [255:0]      d_reg;          // RNG output d
     reg [255:0]      rho_reg;        // G output rho
     reg [255:0]      sigma_reg;      // G output sigma
+    wire [255:0]     d_rev;          // byte-reversed d (FIPS 203 byte order)
+    genvar gi;
+    generate
+        for (gi = 0; gi < 32; gi = gi + 1) begin : gen_d_rev
+            assign d_rev[gi*8 +: 8] = d_reg[(31-gi)*8 +: 8];
+        end
+    endgenerate
     reg [255:0]      m_reg;          // Encaps message m
     reg [255:0]      Kbar_reg;       // G output K-bar
     reg [255:0]      r_reg;          // G output r
@@ -1490,7 +1497,7 @@ module mlkem_top #(
     sha3_chain_top_shared u_chain (
         .clk          (clk),
         .rst_n        (rst_n),
-        .d_in         (d_reg),
+        .d_in         (d_rev),
         .start_i      (chain_start),
         .done_o       (chain_done),
         .rho_out      (chain_rho),