RISC-V: mret sets mstatus.MPP=U on harts without U-mode

[carlosqwqqwq]

RISC-V: mret sets mstatus.MPP=U without U-mode

Rechecked revision

The report was rechecked against the public Unicorn dev branch at
938efd13aeab73155f31cf707a2094c6ccaa36dd.

Problem

helper_mret always writes mstatus.MPP = PRV_U. On a hart whose ISA omits
U-mode, M is the least-privileged supported mode, so the post-mret MPP state
must remain M rather than becoming U.

Public reproducer

The witness and the explicit U-clear riscv_any build-profile patch are
available at
https://github.com/carlosqwqqwq/unicorn-riscv-repros/tree/main/u034.
Apply patches/no-u-any.patch to a clean public Unicorn checkout, build it,
set LIBUNICORN_PATH to that build, and run u034/run.sh. The no-U run must
read back MPP=3; a U-enabled control remains unchanged.

The profile patch is public and only constructs the no-U test configuration;
it does not hide any source change used by the proposed fix.

Expected behavior

mret must select the least-privileged mode implemented by the hart: U when
U-mode exists, otherwise M.

Root cause and proposed fix

Select PRV_U only when RVU is present and select PRV_M otherwise. The
focused change is included in PR #2396.