feat: U5 land deterministic chacha20 KAT (RFC 8439 2.4.2)

- test/gen_chacha_kat.py emits KAT from RFC 8439 section 2.4.2 mapped to the impl's 64+64 counter/nonce layout; expected bytes cross-checked against pycryptodome (independent impl) and the official vector: 10f1e7e4d13b5915... byte-exact
- verdict: the 'intermittent chacha20 KAT FAIL' referenced in FUCK comments was a phantom — that test was never merged into this tree; the implementation itself matches RFC byte-for-byte
- selftest now runs KAT + page-MAC determinism checks at selftest=2; full SELFTEST PASS in QEMU (.build_tmp/qemu_serial_u5kat.log)

docs/ROADMAP_INSANE.md

@@ -46,7 +46,7 @@ Deshab 最标志性的疯点——给空气上锁。
 | U2 | UTRW Fast/Slow Path 真分支 | 快慢路不是画出来的 | ✅ | Fast path ✅；Slow path ✅（EPOCH/KEY_MISS 恢复，MAC_FAILED/POISONED 交 DRR，selftest PASS） |
 | U3 | `@sealed` 段可选标记 | 用户能选锁不锁 | ⬜ | 链接脚本支持 `__sealed` section；未标记段 0 开销 |
 | U4 | 密文页 dump 工具 | 发疯也要可调试 | ✅ | `utrw_debug_dump_page`：串口 64B 密文/明文 hex 对照，selftest 内置演示（QEMU PASS） |
-| U5 | UTSM selftest 全覆盖 | 把🔶刷成✅ | 🔶 | chacha20 KAT/段表/越界已覆盖，KAT 间歇 FAIL 待修；覆盖率目标 ≥70% |
+| U5 | UTSM selftest 全覆盖 | 把🔶刷成✅ | ✅ | chacha20 KAT = RFC 8439 §2.4.2 官方向量（三方对拍）；"间歇 FAIL" 确认为幽灵缺陷（从未合并进树）；KAT+MAC 确定性+段表+越界+调度+DRR 全量稳定 PASS |
 
 二期做完：UTSM 从"设计"变"可开关的特性"，疯得有旋钮。