Add tb_mlkem_two_inst_xsim: runs the hello_world protocol across TWO mlkem_top
instances, modeling the real two-party split:
* u_genenc: KeyGen THEN Encaps on one instance. KeyGen writes ek into its own
ek_bram and Encaps reuses it directly (no re-streaming) -> shared_key, ct.
* u_dec: Decaps on a separate instance, receiving dk + ct streamed over from
u_genenc via the input ports.
Verifies A.shared_key == B.recovered_key and 'hello world' round-trips. Output
matches the single-instance TB and the Rust reference (key=ced0c031a4bee34a...).
run_hello.sh gains a 'two' arg to select this TB; default stays single-instance.
FallenSigh
ee2bf1cda8