t27b port: decode_bitmask and disasm_fp of a64.rs move into a64.t27 (round trip against bitmask_field) #9067

Part of the t27b port (see #6198, epic #8326). t27b must be generated entirely from .t27. cli/t27b/src/a64.rs is almost glue already: the encoders live in specs/tri/t27b/a64.t27. What is left by hand there is the decoding side: decode_bitmask (27 lines of bit arithmetic) and disasm_fp (the floating-point half of the disassembler).

User Scenarios

• Given a64.t27 already has bitmask_field (encode), when decode_bitmask moves into the same spec, then a test can check the round trip decode_bitmask(bitmask_field(v)) == v for known logical immediates. That gives the decoder an oracle instead of a restated formula.
• Given the hand bodies are deleted from a64.rs, when t27b disassembles its own output (t27b --disasm), then the text is byte-identical to before.

Requirements

• FR-001: decode_bitmask(n, immr, imms, sf) -> u64 and the decision of disasm_fp(w) -> ?text MUST live in specs/tri/t27b/a64.t27, extending that spec. Do not create a new spec (DRY, see AGENTS.md and the t27b-loop skill: DRY -- never add a spec or function that already exists #8963).
• FR-002: Every moved function MUST have at least one test that calls it by name. decode_bitmask MUST be tested by round trip against bitmask_field on at least 4 values: 0x5555555555555555, 0x00ff00ff00ff00ff, 0x0000000000000001 with sf, and 0xfffffffe without sf.
• FR-003: gen/rust/tri/t27b/a64.rs MUST be the unedited output of t27c gen-rust specs/tri/t27b/a64.t27 (L2). cli/t27b/src/a64.rs keeps only thin glue that calls enc::. The PR MUST be net <= 0 in hand-written lines (policy: hand-written code in any language but t27 may only shrink (Closes #8227) #8236).
• FR-004: cargo test -p t27b MUST pass, and t27b's corpus verdicts MUST NOT change. This is a pure port.
• FR-005: Do not edit docs/reports/t27b_expectations.json or .trinity/seals/; the steward adds them at merge.

Success Criteria

• grep -c 'pub fn decode_bitmask' specs/tri/t27b/a64.t27 prints 1
• grep -c 'leading_zeros' cli/t27b/src/a64.rs prints 0
• With the criteria above satisfied, grep -c 'decode_bitmask(bitmask' specs/tri/t27b/a64.t27 prints at least 4
• wc -l < cli/t27b/src/a64.rs prints a number below 340 (it is 407 on master)

Boundary

• specs/tri/t27b/a64.t27
• gen/rust/tri/t27b/a64.rs
• cli/t27b/src/a64.rs