Fix M-extension funct7 decoding

[cassuto]

Previously it used (funct7 & 0x1), which could decode reserved odd funct7 values as M-extension instructions while RTL requires the exact 7'b0000001 encoding. This masked illegal instructions instead of triggering abort().

[tinebp]

Review (maintainer)

Verified on master @ 1c3403d: the bug is live at sim/simx/decode.cpp:524 — funct7 & 0x1 decodes reserved odd funct7 values (0x3, 0x5, 0x21, …) as M-extension ops, while the RTL decoder's exact case (funct7) match falls through to the base-ALU default for them. That is a functional SimX↔RTL divergence: e.g. an R-type word with funct7=0x3, funct3=0 executes as MUL on SimX and as ADD on RTL. Applied the fix locally: all 8 rv32um-p-* ISA tests pass, plus the full tests/regression simx suite (81/81).

Why CI never caught it: no compiler emits reserved encodings, and no test in the tree exercises them — CI only ever sees canonical funct7 values. A conform test that executes a reserved-funct7 word via .insn and asserts the RTL-matching decode (base-ALU ADD, not MUL) will be added alongside this fix so the kernel CI category (simx + rtlsim, both XLENs) locks the parity in.

Code review: one-line change, matches the C++ guidelines; the other funct7 & 0x1 uses in the file (RV64 shamt bit, FPU fmt) are legitimate and correctly untouched.

Note on merging: this branch carries the pre-3.0 history (no common ancestor with today's master), so it will be squash-merged to keep master's history clean — your authorship is preserved in the squashed commit.

Accepting.

[tinebp]

Verified locally: rv32um ISA suite + full simx regression pass; decode now matches the RTL's exact funct7 case-match.

[tinebp]

CI coverage for this fix landed in #398 — a conform test executing a reserved funct7 encoding and asserting the RTL-matching decode (validated to fail under the pre-fix behavior).