fix(hp): order OpenC906 write bursts behind their pad AW issue

The vendored BIU streams a writeback's W data as soon as the victim
buffer offers it (AXI-legal W-before-AW), while the AW still waits in
awbuf for the serializing 128->64 downsizer to finish the previous
write (the ~200-cycle SDRAM write response latency). The Mini HP
fabric behind the pad is single-outstanding (downsizer + MMIO demux +
target guard, no WID), so the early W beats are absorbed into the
previous write's burst; each write's AW then arrives to find its W
already consumed by the previous write's stream. The cascade persists
until the LSU freezes (its fills block behind the SDRAM write channel,
which is parked waiting for the orphaned write's W data), leaving a
final orphaned AW whose W beats never come: the target guard parks in
WriteStream, the SDRAM core parks in its write-data state and blocks
the pending read fill, and the C906 stalls at the next LSU-serializing
instruction.

Event-level tracing pinned the mechanism: with the guard parked, the
C906 write side is fully idle (victim buffer idle, store buffer idle,
BIU write-selection FIFO empty, zero W beats presented at the 128-bit
port for the wedged write) while the guard and the SDRAM controller
both hold the orphaned write's AW.

The rtl/mini/ip_overrides/aq_biu_write_channel.v override gates the W
stream on the burst's AW having been issued on the pad (pad-issued-AW
vs completed-W-burst order counters), restoring the AW-before-W order
the fabric requires without touching the vendored checkout. The
generator registers the override under the pinned sha256 guard, and
the Makefile stamps it as a dependency.

Evidence: the deterministic wedge payload and the no-fence control run
unbounded (previously wedged at ~22 rounds); hp-smoke-sim and
hp-rtthread-sim pass (SIM_TEST_PASS code=0); hp-linux-sim completes
userspace acceptance (Run /init as init process, HP_LINUX_INIT_PASS,
retroSoC HP Linux ready, HP_LINUX_READY, SIM_TEST_PASS code=0, 1.63 G
emulator cycles, status: passed with no missing markers); pytest
tests/test_hp_platform.py passes 20/20. docs/hp-rv64-validation.md
records the mechanism and the acceptance.

scripts/generate_openc906.py

@@ -10,6 +10,15 @@ for their vendored counterparts:
 
 - ``aq_sysio_kid.v``: upstream hardwires mhartid to 0; the Mini LP/HP
   contract requires the HP core to report hart 1.
+- ``aq_biu_write_channel.v``: the vendored BIU streams a write's W data as
+  soon as the LSU offers it, even while the AW still waits in ``awbuf`` for a
+  busy downstream slave (AXI-legal W-before-AW). The Mini HP fabric behind the
+  pad is single-outstanding (serializing 128->64 downsizer + MMIO demux +
+  target guard) and cannot attribute early W beats without a WID, so the
+  beats land in the prior write's burst, the queued AW is orphaned, and the
+  channel wedges (observed as a permanent guard WriteStream stall with the
+  SDRAM controller parked waiting for write data). The override gates the W
+  stream on the burst's AW having been issued on the pad.
 - ``sysmap.h``: the upstream default region table marks the Mini peripheral
   window cacheable/bufferable; the override maps the Mini address map with
   the MMIO window (including the core-internal CLINT/PLIC window) as
@@ -64,6 +73,10 @@ OVERRIDES = {
         "sysmap.h",
         "0389089a42ef762768e57bbb4fdcbe6b95f33ab650b5bacc0de8122e0d8711d5",
     ),
+    "C906_RTL_FACTORY/gen_rtl/biu/rtl/aq_biu_write_channel.v": (
+        "aq_biu_write_channel.v",
+        "7d98d231287f4a8807593990411d96879deb68cfda764c2fb92bc93c2b10e204",
+    ),
     "C906_RTL_FACTORY/gen_rtl/ifu/rtl/aq_spsram_1024x16.v": (
         "aq_spsram_1024x16.v",
         "8969cdfd73933ff4ca105d562e31283e16433f90e4ceaa4339759e6df7ba34d9",