feat(v2): M4 Memory Manager + Prefetch Engine, real V1 PSRAM backend

Implements M4: memory_manager.v (arbitration/buffering/forwarding/
latency hiding/double buffering, §12) + prefetch_engine.v
(double-buffered tile fetch, §13), sitting on the REAL, UNMODIFIED V1
PSRAM backend chain (int8_memory_access.v -> memory_interface.v ->
psram_controller.v, per §15's explicit mandate not to touch the
controller).

Verified fully end-to-end with Verilator: real neural_processor (M1)
fed entirely by memory_manager, computing against PSRAM-resident X/W
tiles (double-buffered prefetch across up to 5 tiles) and writing its
result back to PSRAM -- checked via an independent PSRAM read-back,
with poison bytes around the operand regions to catch addressing
errors. 3/3 jobs pass (1/3/5-tile configurations).

Three real RTL bugs found and fixed during integration (full
diagnostic trail in errors.log ERR-0006): prefetch_engine had no
single-in-flight-request discipline, letting a queued request corrupt
the bank bookkeeping of a fetch already running; the fix's own
!pf_busy guard had a one-cycle blind spot (pf_busy lags pf_start by a
clock) that needed an explicit !pf_start term; and a state-based mux
for the shared backend port was off by one cycle, silently dropping
the PSRAM result write entirely.

Real synthesis: 0 CHECK problems, 851 LUT4/789 FF/108 CCU2C/0 DSP
(expected, no multiplication in this module). Real place&route (via a
synthesis-only timing harness, needed for the same TRELLIS_IO pin-
budget reason as M2's array): Fmax 165.86 MHz, PASS at 80MHz.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013xXuuRUWZScuo1DeYJxs3v

hardware/v2/logs/simulation.log

@@ -36,3 +36,15 @@ vectors: extreme INT8 (-128, 127, -100, 100), regular values, full
   writes undisturbed
 simulator: Verilator 5.050 (--binary --timing)
 PASS/FAIL: 10/10 PASS
+
+[2026-09-05] EXP-0005 -- hardware/v2/sim/tb_memory_manager.v
+test: 3 end-to-end jobs (3-tile/saturating, 1-tile/non-saturating,
+  5-tile/steady-state-swap), real V1 PSRAM backend chain (unmodified),
+  real M1 neural_processor
+simulator: Verilator 5.050 (--binary --timing)
+PASS/FAIL: 3/3 PASS
+bit-exact result: PSRAM-read-back result byte matches hand-computed
+  expectation in every case (independent oracle, not derived from the
+  RTL under test)
+cycles: 446 (3 tiles), 166 (1 tile), 728 (5 tiles) -- real PSRAM
+  latency dominates, not memory_manager's own control overhead