feat(sha3): implement synchronous Keccak-f[1600] core with G/H/J modes

Phase 1.1 of ML-KEM sync rewrite.
- keccak_round.v: combinational theta/rho/pi/chi/iota
- keccak_core.v: 24-round pipeline, valid/ready
- sha3_top.v: sponge FSM, modes G(SHA3-512)/H(SHA3-256)/J(SHAKE-256)
- Verilator C++ TB + Python vector gen against reference
- Verified: 25/25 vectors bit-exact vs Python G()/H()/J()

test_framework/modules/sha3/test_plan.json

@@ -0,0 +1,31 @@
+{
+  "module": "sha3",
+  "rtl_top": "sync_rtl/sha3/sha3_top.v",
+  "rtl_deps": ["sync_rtl/sha3/keccak_core.v", "sync_rtl/sha3/keccak_round.v"],
+  "tb_cpp": "sync_rtl/sha3/TB/tb_sha3.cpp",
+  "simulator": "verilator",
+  "timeout_s": 120,
+  "cases": [
+    {
+      "id": "g_basic",
+      "description": "SHA3-512 G(d||k): 64B input → 64B output, verified against Python reference",
+      "params": {"mode": "G", "k": 2},
+      "num_vectors": 10,
+      "tolerance": "bit_exact"
+    },
+    {
+      "id": "h_basic",
+      "description": "SHA3-256 H(ek): 32B+ output, single-block",
+      "params": {"mode": "H", "k": 2},
+      "num_vectors": 10,
+      "tolerance": "bit_exact"
+    },
+    {
+      "id": "j_basic",
+      "description": "SHAKE-256 J(z||c): variable input → 32B output",
+      "params": {"mode": "J"},
+      "num_vectors": 5,
+      "tolerance": "bit_exact"
+    }
+  ]
+}