feat(enc): Encaps E0 - op_i/msg_i/ek-load scaffold + H(ek)+G(m||H(ek))

Extend mlkem_top with a runtime op_i select (0=KeyGen, 1=Encaps) and the
first Encaps stages, reusing the shared keccak_core and the ST_H multi-block
SHA3-256 machinery:
  ST_ENC_H: H(ek) over preloaded ek_bram (same FSM as KeyGen ST_H)
  ST_ENC_G: (K,r) = G(m||H(ek)) via new 64-byte single-block SHA3-512

- sha3_top_shared: add mode=2'b11 = SHA3-512 over a full 512-bit message
  (g512_pad). Standalone tb_sha3_g512 confirms it byte-exact.
- mlkem_top: new ports op_i, msg_i, ek_in_{we,addr,byte} (ek preload), ss_o,
  dbg_ct_*, dbg_r_o/dbg_hek_o. st widened 4->5 bits; ST_ENC_* states added.
  Renamed message port to msg_i to avoid collision with ST_M counter m_i.
- TB tb_mlkem_enc_katK + gen_encaps_vectors.py (per-byte ek/m/ct/ss vectors).

Verified ss==KAT.ss for K=2/3/4, cases 0-2 (all PASS). KeyGen unaffected
(K=2 c0 still ek==pk, dk==sk byte-exact).

sync_rtl/sha3/sha3_top_shared.v

@@ -63,6 +63,7 @@ module sha3_top_shared (
     // Absorb state: message || suffix || pad10*1 into rate bits
     // ================================================================
     wire [575:0]  g_pad;
+    wire [575:0]  g512_pad;
     wire [1087:0] h_pad;
     wire [1087:0] j_pad;
 
@@ -70,12 +71,15 @@ module sha3_top_shared (
     assign h_pad = {1'b1, {828{1'b0}}, 1'b1, 2'b10, data_i[255:0]};
     // J: SHAKE suffix is "1111" — all ones, order irrelevant
     assign j_pad = {1'b1, {570{1'b0}}, 1'b1, 4'b1111, data_i[511:0]};
+    // mode 11 = G over a full 64-byte (512-bit) message (Encaps: G(m||H(ek))).
+    // SHA3-512 rate=576; suffix 01 + pad10*1: 1 + 60 zeros + 1 + 2'b10 + 512 = 576.
+    assign g512_pad = {1'b1, {60{1'b0}}, 1'b1, 2'b10, data_i[511:0]};
 
     wire [1599:0] absorb_state;
     assign absorb_state = (mode == 2'b00) ? {{(1600-576){1'b0}}, g_pad} :
                           (mode == 2'b01) ? {{(1600-1088){1'b0}}, h_pad} :
                           (mode == 2'b10) ? {{(1600-1088){1'b0}}, j_pad} :
-                          1600'd0;
+                                            {{(1600-576){1'b0}}, g512_pad};
 
     // ================================================================
     // Multi-block SHA3-256 absorb FSM (active only when mb_en=1)