SPI host DV - Top-level loopback smoke test

Nobody has claimed this yet.

Implement the chip-level SPI host loopback smoke test (`chip_spi_host_smoke`, testplan V1).

The UVM testbench (`hw/top_chip/dv/tb/tb.sv`) already wires `spi_host_sd_o[0]` (COPI) to `spi_host_sd_i[1]` (CIPO) as a hardware loopback in standard SPI mode, so no SPI agent is required for this test.

Scope:
- SW initialises the SPI host by writing its configuration registers (`CONTROL`, `CONFIGOPTS`, `CSID`) and reads back a configuration register to confirm reachability via `xbar_peri`.
- SW writes a known 32-bit word (e.g. `0xDEADC0DE`), reads one word back over the loopback, and passes if the received value matches.

Notes:
- Registered as `spi_host_smoke` / `spi_host_smoke_cheri` in `hw/top_chip/dv/top_chip_sim_cfg.hjson` (currently placeholder).
- The existing `sw/device/tests/spi_host/sdcard_tests.c` is a separate, unrelated test and is not this smoke; a dedicated minimal loopback smoke SW image is needed.
- Both vanilla and CHERI firmware images should be exercised.

Testpoint: `chip_spi_host_smoke` in `hw/top_chip/data/chip_testplan.hjson`.

Start with hw/top_chip/dv/tb/tb.sv and the placeholder entries in hw/top_chip/dv/top_chip_sim_cfg.hjson, then read the chip_spi_host_smoke testpoint in hw/top_chip/data/chip_testplan.hjson. Add the dedicated minimal loopback smoke firmware rather than reusing sw/device/tests/spi_host/sdcard_tests.c, and verify matching data with both vanilla and CHERI images.

Written by the indexing model from the issue text.