Support memory access with callee-saved registers

The aarch64-rt exception frame only saved volatile registers, so a trapped memory access using x19-x28 as Rt could not be read or updated by the MMIO emulation path. That made otherwise valid guest load/store instructions fall through as unhandled Data Aborts.

Provide a RITM-owned EL2 vector table and trap frame that saves x0-x30 before calling the Rust handler, while keeping HVC/SMC forwarding limited to the SMCCC x1-x17 argument ABI. Add integration coverage for filtered MMIO through x19 and x28.