t27b: the AArch64 instruction encoders are a t27 spec (port slice of #6198) #7531

Port slice of #6198 (t27b written in t27), under #6063 and #5980.

cli/t27b/src/a64.rs (1067 lines of hand-written Rust) holds the AArch64 instruction encoders that t27b's code generator and JIT call: each function builds one 32-bit instruction word from register numbers and immediates. Those encoders, the condition/extend/shift/logical-op enums, the register and access-kind constants and the two patch helpers (adrp_patch, add_imm_patch) move into specs/tri/t27b/a64.t27. They reach cli/t27b through t27c gen-rust as gen/rust/tri/t27b/a64.rs and are mounted like check_budget.

What stays hand-written in a64.rs, and why:

• impl Cond { invert, name, from_bits } -- name returns &'static str and from_bits indexes a table; both are disassembler support.
• bitmask_imm (the logical-immediate search, returns Option<(u32, u32, u32)>, loops over u64 rotations), mov_imm (pushes into &mut Vec<u32>), and logic_imm (calls bitmask_imm, then the generated logic_imm_word).
• xr, disasm, disasm_fp, decode_bitmask -- the t27b asm disassembler builds Strings.

These are the next slices.

Oracle and checks

• Expected words come from the current Rust and from the 173 clang-checked cases in cli/t27b/tests/encoder.rs. A sample is cross-checked against LLVM's assembler (zig cc -c, then objdump -d).
• Mutation check: every numeric literal in the encoder half of the spec is perturbed, one per copy, and t27c test-report must go red.
• Done means: t27b cargo test passes, the t27b lab corpus counts for head equal master's with mismatch 0, the hand-glue budget (Only-t27 gate: a foreign-line budget the label cannot lift; local hook reads exceptions from origin/master #7371) holds, and the AGENTS.md t27b debt line shrinks.