Perf/dma tail wide memset - #896

Routes the guest's strong `memset` symbol through a bounded DMA ecall, the
same shape as the memcpy stub #874 added, and proves each chunk with a new
20-column DMA_SET table.

memset is cheaper than memcpy rather than a copy of it: there is no source to
read, so a row emits one MEMW write and no read (half the memory traffic per
byte), and every byte written is the same constant, so one `fill` column
replaces memcpy's eight value lanes. `fill_wide` is `fill` on eight-byte rows
and zero on one-byte tail rows, which lets one write tuple serve both widths.
`fill <= 255` is proven on the first row; the executor rejects wider values and
the guest stub masks a1, mirroring how the byte-count bound is handled.

Measured on real mainnet block 25368371 (50,781,394 cycles baseline):
  #874 memcpy alone   41,642,609  -17.99%
  + memset (this)     40,338,153  -20.57%
mem* routines fall from 24.41% to 4.84% of guest cycles.

No existing AIR changes: CPU stays at 38 columns and the new table only adds
senders to existing buses.

Resolve the accelerator() conflict: the base gained DMA cycle counting
(DmaMemcpy => Some(Accelerator::Dma)) while this branch added DmaMemset and
classified both as None. Keep the counting semantics and extend them:
DmaMemcpy | DmaMemset => Some(Accelerator::Dma).

Two exhaustiveness follow-ups the merged tree needs to compile and pass:
- SyscallNumbers::raw() gets the DmaMemset arm (DMA_MEMSET_SYSCALL_NUMBER).
- The CLI's EXPECTED_ACCELERATORS gets a DmaMemset row, required by
  accelerator_of_mirrors_prover_classification's one-row-per-syscall check.