P29 moves the timer onto an MMIO map

P29 removes the P28 timer-control shortcut. Instead of writing custom CSRs at 0x7c0 and 0x7c1, software now writes memory-mapped platform registers.

Commands:

make -C projects/29_rv32i_mmio_platform/test
make -C projects/29_rv32i_mmio_platform/test act4

Results:

check	result
External RAM plus MMIO UART	`PASS`
MMIO timer interrupt with `mret`	`PASS`
External interrupt through platform shell	`PASS`
ACT4/Sail `rv32i/I`	`PASS=39 FAIL=0 NOT RUN=0`
Hardening	`NOT RUN`
Official privileged tests	`NOT RUN`

The new map is:

address	register
`0x1000_0000`	`mtime`
`0x1000_0004`	`mtimecmp`
`0x1000_1000`	UART status
`0x1000_1004`	UART data

This is still a teaching platform, not a complete CLINT/PLIC story. But it is the right direction: timer and UART behavior are now reached by normal loads and stores, not testbench-only CSRs.

Next, P30 should stop hand-assembling every test program and add a tiny runtime: linker script, reset entry, trap handler, and small C or assembly examples that target this map.