feat(sha3): multi-block SHA3-256 absorb for H(ek); KeyGen golden vectors

Stage 0+1 of mlkem_top KeyGen integration:
- sha3_top: add multi-block SHA3-256 absorb FSM (mb_en/mb_block_i/mb_valid_i/
  mb_last_i/mb_ready_o). Caller pre-pads final block; module does pure absorb
  loop (state^=block; Keccak-p). Single-block G/H/J paths bit-identical when
  mb_en=0. Sticky digest register holds output until consumer acks.
- tb_sha3_mb_xsim: self-checking TB streams 800B ek (6 blocks) -> H(ek),
  verified == hashlib.sha3_256. Proper valid/ready handshake (no force).
- Existing G/H/J TBs (xsim + Verilator) tie off mb_* ports; both frameworks
  regress clean (Verilator 25/25, XSIM G/H/J + keccak + 7-vec + multiblock).
- test_framework/modules/mlkem_keygen/golden: full 256-coeff per-stage
  intermediates (rho/sigma, A_hat, s/e, s_hat/e_hat, t_hat, ek, dk_pke) for
  KAT count=0..4, dumped by ml-kem-r and self-verified against NIST KAT.

sync_rtl/sha3/TB/tb_sha3_xsim.v

@@ -56,7 +56,13 @@ module tb_sha3_xsim;
         .ready_o  (ready_o),
         .hash_o   (hash_o),
         .valid_o  (valid_o),
-        .ready_i  (ready_i)
+        .ready_i  (ready_i),
+        // multi-block absorb path disabled for single-block G/H/J tests
+        .mb_en      (1'b0),
+        .mb_block_i (1088'b0),
+        .mb_valid_i (1'b0),
+        .mb_last_i  (1'b0),
+        .mb_ready_o ()
     );
 
     // ================================================================