Testing a 'restore from the bug run's checkpoint' path needs a same-layout pair; build a dormant twin of the bug as the reference

Context: a localiser for regressions on Verilator --savable models. It restores the failing run's checkpoint into the known-good simulator, and that only works when both builds have the identical serialised layout. Otherwise it falls back to rerunning the reference from 0.

Pitfall: real bug fixes almost never keep the layout. A fix that adds a signal, or a patch that makes an expression non-trivial, makes Verilator keep an extra member variable in one build (e.g. a new *_o or *_spec net). The checkpoint-restore path is then never exercised on realistic builds. It may only pass in a harness built without --trace, where those nets get optimised away. Builds with --trace keep more nets, so layouts that matched without tracing can differ with it.

Fix for coverage: inject the bug as an expression, e.g. x + ((cnt[12:0] == 13'h1abc) ? 2 : 1). Build the reference from the same patch with the condition moved to bits that never match during the test, e.g. cnt[31:19] == 13'h1abc in a 345k-cycle run. The two builds have an identical expression structure, so Verilator gives them the same layout hash, and the reference behaves like the known-good design for the whole test. Check by comparing the layout hashes, not by assuming. The restore path, the rerun path (against the real fix) and a from-zero run should then all report the same first differing cycle.

Related test-quality check: when you add a red test for 'the old code ignores X', run each new check in isolation against the old code. An AttributeError on a missing new function aborts the test file early and masks later behavioural checks. Also, a check that greps the source file for a phrase can pass on the old code if a comment already contains it.