cosim: key checkpoints on retired-instruction count, not guest cycles

[Alexbeav]

Problem

The first-divergence oracle keyed checkpoints on guest cycles, but the
hash/park happened at the first cosim_instr boundary AFTER the stride
cycle was crossed. The two backends can reach that crossing at different
retirement positions (charges land in different lumps mid-instruction),
so the oracle compared different architectural states. Observed on CMR2
as a +5-cycle park skew and phantom CPU-register divergences; the WARN
in cosim.py fired on every run past ~6.7e9 cycles, making verdicts
untrustworthy on mixed-mode titles.

Fix

Checkpoints are now taken inside cosim_instr, keyed on the retirement
count itself. Both backends call cosim_instr exactly once per
retirement event (a branch and its delay slot retire as ONE event in
both the dirty-RAM interp and the emitted code), so checkpoint k is
"the state after k*stride retirements" on both sides by construction.
The guest-cycle clock stays inside the state hash, so real
cycle-accounting drift still flags — now pinned to an exact instruction
window instead of corrupting the alignment.

cosim.py: stride/--max/--start-cycle are now retirement units; the
cycle-skew warning reports a real timing divergence; launch() gives
instance B its own exe copy (the mods root is exe-dir-relative —
exe_dir_from_argv(argv[0]) / "mods" — so a shared exe races on
mods/state.toml publish regardless of cwd separation) and refuses a
stale COSIM_CWD_B exe.

Validation (CMR2, SLUS-01222)

• Gate 1: compiled/compiled and interp/interp both clean over 100M
  retirements — with IDENTICAL chain values across the two pairs
  (compiled==interp through ~465 frames).
• Gate 4: injected 1-bit RAM fault detected at the next checkpoint.
• The corrected oracle then found a REAL first divergence at retirement
  3,203,596,289 that the cycle-keyed design had been mislocating — the
  stale-static overlay bug fixed in the companion PR.