Model a microcontroller: a Cortex-M7 SKU and a DTCM capacity demo

The capacity check answers a question embedded developers already ask and answer late: does this
buffer fit in SRAM. Today that is a linker job -- place a section, link, and read a region-overflow
message naming a region and a byte count with no source location. The check in
src/hir/check/transfer.rs answers it in the frontend against a declared capacity.

Nothing in fleet/ demonstrates that, because every machine there is a GPU or a server CPU. A
microcontroller model makes the point on hardware where the question is routine.

Scope:

• fleet/cortex-m7.vx, an STM32H743. The three fleet roles map onto it as HBM = 512 KiB AXI
  SRAM, L2 = the 16 KiB L1 data cache, SMEM = the 128 KiB DTCM. The TCM really is the same kind
  of space as GPU shared memory -- explicitly placed, guaranteed resident, fast because it is not a
  cache -- so the same check decides both.
• A rejected case and an admitted one over the same three 48 KiB buffers, differing only in block
  structure: 144 KiB all live is E6010, and 144 KiB where two never coexist is admitted at a 96 KiB
  peak. That difference is what a linker script cannot express, since section sizes add up whatever
  the lifetimes are.

Not in scope: Vx emits no code for the part. arch: thumbv7em has no entry in
arch_triple_and_datalayout, so a program reaching codegen is refused rather than mis-targeted.
The placement and capacity checks are frontend work and need no backend.

Known gaps this surfaces, worth separate issues if they are worth fixing:

• E6009/E6010 carry no source span, so neither names the line that placed the tile. That is the
  main thing the linker also fails to do, so it is the interesting half to close.
• A bare-metal part has no host, but --host default is still required or E6014 fires. On this
  machine the host memory and the device memory are the same SRAM.
• The DMA1/DMA2 controllers cannot reach DTCM on this part. The model has no way to say that an
  edge exists for one engine and not another.

Start with src/hir/check/transfer.rs and the existing examples in fleet/ to understand the capacity-check syntax and fleet roles. Add fleet/cortex-m7.vx for the STM32H743 model, then verify that the three 48 KiB buffers are rejected when all live and admitted when two do not coexist, without reaching codegen.