[earlgrey] add QEMU support

Wire the lowRISC QEMU ot-earlgrey machine into target/earlgrey as a
target (parallel to verilator). QEMU runs ~50x faster
than verilator (2.6s vs minutes) and is part of the earlgrey_qemu_tests
workflow within ci so the tests run on every PR.

Active QEMU tests:
- //target/earlgrey/tests/ipc/user:ipc_runner_qemu_test        PASS 2.6s
- //target/earlgrey/tests/threads/kernel:threads_runner_qemu_test  PASS 12.5s
50/50 stability runs, zero flakes.

Build changes:
- third_party/qemu/: lowRISC QEMU release archive pinned to
  v10.2.0-2026-01-15; hermetic pip-parse for hjson + pyelftools
  (@openprot_python_deps, Bazel-managed Python 3.11).
- third_party/opentitan_rtl/: vendored RTL constants for cfggen.
  RMA OTP vmem consumed from @opentitan_devbundle (no local copy).
- target/earlgrey/tooling/qemu.bzl: qemu_cfg / qemu_otp / qemu_flash
  rules + pure-function helpers callable from opentitan_runner.bzl.
- target/earlgrey/tooling/qemu_runner.py + qemu_start.sh: Python
  harness with HMP cont, UART Unix-socket reader, pw_tokenizer
  detokenization, SIGTERM-safe cleanup.

Target glue:
- target_type=qemu added; entry.rs .fake_rom_ext cfg widened from
  `verilator` to `any(verilator, qemu)`.
  Silicon ROM delta verified at 0 bytes.
- config.rs gets qemu SYSTEM_CLOCK_HZ = 24_000_000 (matches
  opentitan/sw/device/lib/arch/device_sim_qemu.c).
- opentitan_runner.bzl gains interface="qemu" branch with _QEMU_ATTRS
  separated from _BASE_ATTRS to avoid testonly contamination of
  non-test opentitan_runner targets. interface attr gained values=[...]
  constraint.

CI: new earlgrey_qemu_tests workflow added to workflows.json, wired
into ci group; ci_tests filters now exclude -qemu to prevent
double-counting.

Signed-off-by: Miguel Osorio <miguelosorio@google.com>