fix(mmu): re-check cached G-stage DTLB-hit permissions after HLVX

[jf-cc727]

• [√] I have searched for similar pull requests
• [√ ] I am a human engaging in an interpersonal interaction. During this interaction, my words are my own and are not generated. If relevant, I provide links to my sources.

This PR fixes a guest-stage permission issue on the cached G-stage / DTLB-hit path after a prior legal HLVX access.

It latches hlvx_inst_i together with the saved LSU request and re-checks guest-stage DTLB-hit permissions against U, A, and the current load R/X rules. This prevents a prior legal HLVX access from causing a later plain HLV load to inherit execute-only permission on a cached translation.

Related issue: #3456

Why this PR is still needed:

#3435 fixes a related but different PTW/page-walk path, where an implicit G-stage access happens while translating a VS-stage PTE address. However, the original CV-1 reproducer still hits an additional cached G-stage / DTLB-hit path in cva6_mmu.sv, which does not go back through that PTW logic.

Validation:

• the original CV-1 reproducer still reproduces on top of fix(ptw): don't apply HLVX rule to G-stage check on VS-stage PTE reads #3435
• the same reproducer passes with this patch applied (tohost = 0)

Current limitation:

This is a targeted fix for the cached guest-stage hit path exercised by the reproducer. It does not refactor the related PTW logic.

[cainria]

Thanks for the contribution,

Do not forget to sign the required ECA

[jf-cc727]

Thank you for your review! I have signed the ECA.