Fix the cross-EEW overlap rule for widening vector operations

rvv_cross_eew_overlap_illegal() applies one condition to both the
widening and the narrowing direction, and says so:

  Both widening and narrowing share this predicate because the spec rule
  is symmetric: overlap is allowed only when the lower-numbered half of
  the wider group is the narrower group itself (reg_a == reg_b).

V 1.0 §5.2 states two conditions rather than one. A destination group may
overlap a source group when the destination EEW is smaller and the
overlap is in the lowest-numbered part of the source group, or when the
destination EEW is greater, the source EMUL is at least 1, and the
overlap is in the highest-numbered part of the destination group.

Narrowing takes the destination as the narrower group, so "lowest part of
the source" does collapse to a shared base register and the predicate
holds. Widening is the wrong end of the wrong group: a shared base
register is accepted where the spec reserves it, and an overlap at the
top of the destination group is rejected where the spec allows it. At
SEW=16/LMUL=1 the destination group of vwadd.vv v0 is {v0,v1}, so
"vwadd.vv v0, v1, v1" is legal and raised an illegal instruction, while
"vwadd.vv v2, v2, v2" is reserved and executed.

Split the predicate in two, keeping the existing test for narrowing and
adding the top-of-destination test for widening, and move the vw* integer
ops, the vwadd/vwsub .w forms and the RVV_FP64_WIDEN_* macros onto the
latter.

The source EMUL cannot be read back from the register span, since
rvv_eew_reg_span() clamps a fractional EMUL up to a span of 1 and leaves
EMUL=1 and EMUL=1/2 indistinguishable, so it comes from rvv_lmul_ratio()
instead. Segment indexed loads are not a widening site at all: the
destination EEW is SEW and the source EEW is the index EEW, with neither
fixed relative to the other, so the direction is selected from the two
EEWs. The spans cannot stand in for that comparison, since a fractional
EMUL clamps to a span of one register and leaves two different EEWs
looking identical.

tests/rvv-smoke.S covers the legal direction, which fails without this
change. The reserved cases stay uncovered: an illegal instruction in user
mode reaches __trap_handler and the run still exits 0, which is the
scaffolding issue #735 asks for.

Author: alanhc