[CHERIoT] Review and improvements to prepare for D2S

- [ ] Address scrambling on the Meta SRAM: Is keeping it disabled OK? Or do we need to extend `prim_ram_1p_scr` to support address scrambling on 38 KiB memories? (See https://github.com/lowRISC/opentitan/pull/30541#discussion_r3807520310 for context.)

As part of D2S, the CHERIoT subsystem must conform to end-to-end bus protection.
* [ ] #30572: lockstep the CHERIoT subsystem
* [ ] lowRISC/ibex/issues/2467: lockstep TRVK in Ibex
* [ ] Ensure capability tag information is transferred as `MuBi4` between the TRVK and CHERIoT lockstep domains.

Start with prim_ram_1p_scr and the Meta SRAM scrambling question, then read the discussion in PR #30541. Review the linked lockstep work in #30572 and Ibex #2467; done means the D2S checklist is resolved, including the 38 KiB scrambling decision and MuBi4 capability-tag transfer.

Written by the indexing model from the issue text.