Clean up the Zcmp directed tests once the toolchain and cosim support Zcmp #2534

As @SamuelRiedel suggested in #2498 (review), this tracks the clean-up of zcmp_reserved_test. The test has two workarounds:

• It writes even the legal Zcmp instructions as raw halfwords, because the pinned GCC toolchain cannot assemble Zcmp.
• It runs with +disable_cosim=1, which makes cosim mismatches non-fatal. The cosim does not enable Zcmp in Spike.

The Zcmp tests in #2500 (dummy_instr_zcmp_test and its debug and interrupt variants) use the same workarounds.

The LLVM toolchain proposed in #2519 assembles Zcmp mnemonics, but only when -march includes Zcmp. These tests pass no -march today. With both in place, the legal instructions can use mnemonics. The reserved encodings should stay raw halfwords. LLVM also rejects the test's .global mtvec_handler, because riscv_test.h already declares it weak.

Removing +disable_cosim=1 needs #2324, which checks expanded instructions against Spike, and #2398, which adds Zcmp to Spike's ISA string. The interrupt variant also needs the cosim to handle a cm.push or cm.pop that an interrupt aborts part-way through, as #2461 describes. CI's Spike build still executes cm.mvsa01 with equal register fields instead of trapping. CI needs a Spike build with the same rule as #2498.

Separately, and optional: zcmp_reserved_test runs with dummy instructions disabled, and no other directed test targets reserved Zcmp encodings. A SecureIbex variant with dummy insertion enabled would cover that combination. The test checks its own results, so this does not need to wait for the cosim.