feat(mlkem_top): KeyGen stages 2a-2c (G, SampleNTT A_hat, CBD s/e)

Fresh valid/ready KeyGen FSM for ML-KEM-512 (K=2, eta1=3). Independent
keccak per consumer (no arbiter). Verified stage-by-stage vs ml-kem-r golden:
- 2a G(d||K): rho/sigma exact (d byte0-low, K at byte32, no reversal).
- 2b SampleNTT: A_hat[i][j] from seed rho||j||i, 1024/1024 coeffs exact.
- 2c CBD: s[i]=CBD3(PRF(sigma,i)), e[i]=CBD3(PRF(sigma,K+i)); signed->mod-q
  (+Q when negative); 2048/2048 (A+s+e) coeffs exact.

polymem register array (10 slots x 256), debug readback tap (dbg_slot/idx ->
coeff, rho/sigma taps) for stage TBs. a_busy/c_busy guards (defensive after
sample_ntt fix). FSM: IDLE->G->A->C->DONE (datapath extended in later stages).

Plan + progress doc in .claude/plans/keygen_plan.md.

sync_rtl/top/TB/tb_mlkem_kg_2a_xsim.v

@@ -0,0 +1,45 @@
+// tb_mlkem_kg_2a_xsim.v - Stage 2a: verify G(d||K) -> rho/sigma in mlkem_top.
+`timescale 1ns/1ps
+module tb_mlkem_kg_2a_xsim;
+    reg clk=0, rst_n=0, start_i=0;
+    reg [255:0] d_i, z_i=0;
+    wire busy_o, done_o;
+    reg [3:0] dbg_slot_i=0; reg [7:0] dbg_idx_i=0; wire [11:0] dbg_coeff_o;
+    wire [255:0] dbg_rho_o, dbg_sigma_o;
+
+    mlkem_top #(.K(2)) dut (
+        .clk(clk), .rst_n(rst_n), .d_i(d_i), .z_i(z_i), .start_i(start_i),
+        .busy_o(busy_o), .done_o(done_o),
+        .dbg_slot_i(dbg_slot_i), .dbg_idx_i(dbg_idx_i), .dbg_coeff_o(dbg_coeff_o),
+        .dbg_rho_o(dbg_rho_o), .dbg_sigma_o(dbg_sigma_o)
+    );
+
+    always #5 clk = ~clk;
+
+    localparam [255:0] D_LIT   = 256'h2426f1941779574d3f1b163bd57f7e173e229e630ec7f7073bdf365137c4bb6d;
+    localparam [255:0] RHO_EXP = 256'h15f74355ca862c3cdf3dab780c35cf24b88bf144706090a1c17e41205f9f1379;
+    localparam [255:0] SIG_EXP = 256'h69b042001b5630b1a039116cbfd29f62c0bde5a6b571504a9fcce68bed667fd5;
+
+    integer c;
+    initial begin
+        d_i = D_LIT;
+        rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk);
+        start_i=1; @(posedge clk); start_i=0;
+        c=0; while(!done_o && c<1000) begin @(posedge clk); c=c+1; end
+        if(!done_o) begin $display("FAIL: timeout"); $finish; end
+        $display("=== Stage 2a: G(d||K) ===");
+        if (dbg_rho_o===RHO_EXP && dbg_sigma_o===SIG_EXP) begin
+            $display("PASS: rho   = %064x", dbg_rho_o);
+            $display("PASS: sigma = %064x", dbg_sigma_o);
+            $display("ALL TESTS PASSED");
+        end else begin
+            $display("FAIL:");
+            $display("  rho got=%064x", dbg_rho_o);
+            $display("  rho exp=%064x", RHO_EXP);
+            $display("  sig got=%064x", dbg_sigma_o);
+            $display("  sig exp=%064x", SIG_EXP);
+        end
+        $finish;
+    end
+    initial begin #50000; $display("FAIL: global timeout"); $finish; end
+endmodule