[pmp]: MML incorrectly suppresses `pmpcfg` writes for OFF and invalid TOR entries

Nobody has claimed this yet.

## Observed Behavior

With `mseccfg.MML=1` and `mseccfg.RLB=0`, Ibex suppresses `pmpcfg` writes that set `L=1` and `X=1` even when the resulting entry does not create a valid executable PMP rule.

The default test writes `pmpcfg0=0x84`, which requests `L=1`, `A=OFF`, and `X=1`. The write is ignored and the test reads back:

```text
observed: 0x00008c00
expected: 0x00008c84
```

The G=1 variant writes `L=1`, `X=1`, and `A=NA4`. Ibex first converts NA4 to OFF, then suppresses the write in the same way.

The invalid-TOR variant writes an entry with `A=TOR`, `L=1`, and `X=1`, but with `pmpaddr[i-1] >= pmpaddr[i]`. The test reads back:

```text
observed: 0x000e009c
expected: 0x000e8c9c
```

## Expected Behavior

Ibex should accept these writes because `A=OFF` does not create a PMP rule, and a TOR entry with `pmpaddr[i-1] >= pmpaddr[i]` matches no addresses.

The MML restriction should suppress only a write that adds a valid M-mode-only or locked Shared-Region rule with executable privileges. The `L` bit should remain writable for an OFF entry.

## Steps to Reproduce

1. Run `./evidence/run_ibex_core_pmp_mml_off_entry.sh`.
2. The assembly enables `mseccfg.MML`, writes `pmpcfg0`, reads it back, and stores the result.
3. Repeat with `./evidence/run_ibex_core_pmp_mml_off_entry.sh program_g1_invalid_na4.S`.
4. Repeat with `./evidence/run_ibex_core_pmp_mml_off_entry.sh program_invalid_tor.S`.
5. Observe that all three writes are suppressed and the readback differs from the requested configuration.

The test intentionally exits through `$fatal` when the observed readback does not match the expected value.

[program.zip](https://github.com/user-attachments/files/31787565/program.zip)

## Testbench

```text
evidence/ibex_core_pmp_mml_off_entry_tb.sv
```

## Environment

Ibex source revision: `57d37bf9008640415532d23ad59018b795c642aa`.

The test uses Verilator and the real `ibex_core` with `PMPEnable=1`. The default case uses `PMPGranularity=0`; the NA4 variant uses `PMPGranularity=1`.

The expected rule definition follows the [RISC-V Smepmp specification](https://docs.riscv.org/reference/isa/v20260120/priv/smepmp.html#term-pmp-rule).

Start with evidence/run_ibex_core_pmp_mml_off_entry.sh, its referenced programs, and evidence/ibex_core_pmp_mml_off_entry_tb.sv; review how the real ibex_core handles MML writes for OFF, NA4-converted OFF, and invalid TOR entries. Run the three reproductions with Verilator, then confirm readback matches the expected configurations and the tests no longer reach $fatal.

Written by the indexing model from the issue text.