feat(mlkem_top): KeyGen stage 4 - H(ek) + full dk, end-to-end KAT pass

Add ST_H stage: second sha3_top (mb_en=1) computes H(ek) over 800B ek as 6
pre-padded SHA3-256 rate blocks. Per block: assemble 136 bytes (h_padbyte
applies 0x06...0x80 padding on final block) into h_block_r, feed (hold valid
until mb_ready drops), wait permute; capture digest on last block into hek_r.

Full dk readback tap: dk = dk_pke(768) || ek(800) || H(ek)(32) || z(32) = 1632B.

End-to-end TB (tb_mlkem_kg_kat_xsim, no force/release): drive KAT count=0 d/z,
run full KeyGen FSM (IDLE->G->A->C->N->M->E->H->DONE), verify:
  ek  == KAT pk (800B)  byte-exact
  dk  == KAT sk (1632B) byte-exact
Done in 21403 cycles. ML-KEM-512 KeyGen complete and KAT-verified.
Prior stage TBs (2c/2e/2f) still pass (no regression).

sync_rtl/top/TB/tb_mlkem_kg_kat_xsim.v

@@ -0,0 +1,68 @@
+// tb_mlkem_kg_kat_xsim.v - Stage 4 end-to-end: full ML-KEM-512 KeyGen vs NIST KAT.
+// Drives d/z (KAT count=0), runs KeyGen, verifies:
+//   ek (800B, sel=0)      == KAT pk
+//   dk (1632B, dk tap)    == KAT sk  (= dk_pke || ek || H(ek) || z)
+// No force/release — pure valid/ready via start_i/done_o.
+`timescale 1ns/1ps
+module tb_mlkem_kg_kat_xsim;
+    reg clk=0, rst_n=0, start_i=0;
+    reg [255:0] d_i, z_i;
+    wire busy_o, done_o;
+    reg [3:0] dbg_slot_i=0; reg [7:0] dbg_idx_i=0; wire [11:0] dbg_coeff_o;
+    reg dbg_byte_sel_i=0; reg [9:0] dbg_byte_idx_i=0; wire [7:0] dbg_byte_o;
+    reg [11:0] dbg_dk_idx_i=0; wire [7:0] dbg_dk_o;
+    wire [255:0] dbg_rho_o, dbg_sigma_o;
+
+    mlkem_top #(.K(2)) dut (
+        .clk(clk), .rst_n(rst_n), .d_i(d_i), .z_i(z_i), .start_i(start_i),
+        .busy_o(busy_o), .done_o(done_o),
+        .dbg_slot_i(dbg_slot_i), .dbg_idx_i(dbg_idx_i), .dbg_coeff_o(dbg_coeff_o),
+        .dbg_byte_sel_i(dbg_byte_sel_i), .dbg_byte_idx_i(dbg_byte_idx_i), .dbg_byte_o(dbg_byte_o),
+        .dbg_dk_idx_i(dbg_dk_idx_i), .dbg_dk_o(dbg_dk_o),
+        .dbg_rho_o(dbg_rho_o), .dbg_sigma_o(dbg_sigma_o)
+    );
+    always #5 clk = ~clk;
+
+    // KAT count=0 (byte0-low literals)
+    localparam [255:0] D_LIT = 256'h2426f1941779574d3f1b163bd57f7e173e229e630ec7f7073bdf365137c4bb6d;
+    localparam [255:0] Z_LIT = 256'h687acf9406694974d383032f7579378f449c75d0560af56cf921ec48404896f6;
+
+    reg [7:0] ek_gold [0:799];
+    reg [7:0] dk_gold [0:1631];
+    integer c, i, errors;
+
+    initial begin
+        $readmemh("sync_rtl/top/TB/vectors/c000_ek_bytes.hex", ek_gold);
+        $readmemh("sync_rtl/top/TB/vectors/c000_dk_full_bytes.hex", dk_gold);
+
+        d_i = D_LIT; z_i = Z_LIT;
+        rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk);
+        start_i=1; @(posedge clk); start_i=0;
+        c=0; while(!done_o && c<600000) begin @(posedge clk); c=c+1; end
+        if(!done_o) begin $display("FAIL: timeout after %0d cyc", c); $finish; end
+        $display("=== Stage 4: ML-KEM-512 KeyGen end-to-end vs NIST KAT ===  done in %0d cyc", c);
+
+        errors = 0;
+        // ek == KAT pk (800B)
+        dbg_byte_sel_i = 1'b0;
+        for (i = 0; i < 800; i = i + 1) begin
+            dbg_byte_idx_i = i[9:0]; @(posedge clk); @(posedge clk);
+            if (dbg_byte_o !== ek_gold[i]) begin
+                if (errors < 8) $display("  EK[%0d] got=%02x exp=%02x", i, dbg_byte_o, ek_gold[i]);
+                errors = errors + 1;
+            end
+        end
+        // dk == KAT sk (1632B)
+        for (i = 0; i < 1632; i = i + 1) begin
+            dbg_dk_idx_i = i[11:0]; @(posedge clk); @(posedge clk);
+            if (dbg_dk_o !== dk_gold[i]) begin
+                if (errors < 8) $display("  DK[%0d] got=%02x exp=%02x", i, dbg_dk_o, dk_gold[i]);
+                errors = errors + 1;
+            end
+        end
+        if (errors == 0) $display("ALL TESTS PASSED: ek==KAT.pk (800B), dk==KAT.sk (1632B)");
+        else             $display("TESTS FAILED: %0d byte mismatches", errors);
+        $finish;
+    end
+    initial begin #40000000; $display("FAIL: global timeout"); $finish; end
+endmodule