[hw] Stall CSR issue until the core response channel can accept the write-back

[emiliengnr]

Hello, here is a pull request for a bug I found.

Problem

A vsetvli write-back to the core can be dropped, and the core then hangs with no trap. The retire
block in spatz_controller.sv drives the response register i_spatz_rsp_register from two
producers. The VFU producer checks rsp_ready_d before it raises valid. The CSR producer does not.
retire_csr fires only while spatz_req_valid is high, which pops the instruction from the
one-entry request buffer that same cycle, and nothing holds the CSR response behind it. A write-back
raised while rsp_ready_d is low is lost. Snitch clears sb_q[rd] only on an accepted response.
The scoreboard bit then stays set for the rest of the run and every later instruction naming that
register stalls in fetch.

Fix

Stall a CON op in the request buffer while the response register cannot take an entry, using the
term the file already applies to the execution units:

-  logic stall, vfu_stall, vlsu_stall, vsldu_stall, vtl_stall;
-  assign stall       = (vfu_stall | vlsu_stall | vsldu_stall | vtl_stall)
+  logic stall, vfu_stall, vlsu_stall, vsldu_stall, vtl_stall, csr_stall;
+  assign stall       = (vfu_stall | vlsu_stall | vsldu_stall | vtl_stall | csr_stall)
                        & req_buffer_valid;
   assign vfu_stall   = ~vfu_req_ready_i & (spatz_req.ex_unit == VFU);
   assign vlsu_stall  = ~vlsu_req_ready_i & (spatz_req.ex_unit == LSU);
+  assign csr_stall   = ~rsp_ready_d & (spatz_req.ex_unit == CON);

retire_csr then fires only on a cycle the channel accepts, and the op retries from the buffer the
way a stalled VFU op does. Bypass is tied to 1'b0 so rsp_ready_d reflects the register full
flags and not the core ready wire straight through. Every build already sets RegisterRsp, so no
configuration changes.