fix(replay): drive payloads and pulse event inputs

[FU-max-boop]

Description

The Replay agent had two event-driving problems:

• replay() assigned sourceId and isKeyword to the bound attributes instead
  of driving the pins through .value, so the L2-hint payload did not reach the
  DUT.
• replay() and Update_blocking() left event valid inputs asserted after
  returning. A later request could therefore observe an event that belonged to
  an earlier driver call. On the generated DUT, a stale TL refill for MSHR 8
  incorrectly cleared blocking for a later MSHR-8 entry.

This change:

• drives the two L2-hint payload pins without replacing their signal objects;
• pulses L2 hint, both store-address events, both store-data events, TLB hint,
  and TL refill valid inputs for one cycle;
• preserves the existing public-driver latency (replay: 4 cycles;
  Update_blocking: 2 cycles) and retains the persistent non-event inputs
  accepted by Update_blocking();
• adds focused agent regressions plus a generated-DUT stale-refill regression;
• makes the generated-DUT fixture deterministic by enabling immediate writes,
  initializing its Replay inputs to idle values, asserting reset before
  toffee.start_clock(dut), and waiting one post-reset idle cycle before the
  first enqueue;
• treats lqFull as the DUT output declared by the RTL instead of driving it
  from the fixture's idle-input helper.

The current branch head is
1b314cad2d7918c4ae21bec1892ed92202389d97. Its third and fourth commits are
test-only; the production event-pulse change remains e73dbac.

Tests

The new agent regressions were overlaid on the exact pre-event-pulse commit and
then run at current head 1b314ca (whose production agent is unchanged from
e73dbac):

00a42d3: 2 failed as expected
1b314ca: 2 passed on Python 3.12.3 and Python 3.10.12

Using the same generated LoadQueueReplay DUT for both controls:

00a42d3 + current test fixture: 1 failed
  expected scheduled == 0, observed scheduled == 1

1b314ca + selected ARM64 generated-DUT tests: 2 passed, with no RTL assertions
  - L2 hint releases only the matching MSHR
  - a prior TL refill is not reused for a later entry; a fresh matching refill
    clears blocking and schedules the held entry

py_compile, git diff --check, and the selected ARM64 generated-DUT tests
pass at current head 1b314ca. In the official x86 image (Python 3.10.12,
Verilator 5.030, public Picker c100874), both agent tests and both selected
generated-DUT tests also pass; the generated-DUT run completed in 591.31 s
with no RTL assertions.

The completed ARM64 generated-DUT run used Python 3.12.3, Verilator 5.020, RTL
archive openxiangshan-kmh-66e9b546-25022801, and Picker commit 6981bc5. That
Picker commit is an unpublished validation-tool workaround supplying a
Verilator-5.020 DPI lookup compatibility fallback needed to construct this
model; it is not a dependency of the Replay-agent source change.

Scope

The ARM64 and official x86 generated-DUT regressions prove stale TL-refill
isolation and fresh-event recovery for one held entry. The other event pulses
and the persistent non-event inputs accepted by Update_blocking() are covered
at the agent boundary. This PR does not claim the full Replay cause matrix,
multi-entry arbitration, or exact scheduling-latency coverage.

Related #133; follow-up to #143 and #157. This PR does not claim to close or
complete #133.