fix(runtime): complete raw SIF DMA init handshake

[hedgeg0d]

Summary

• Capture the EE receive buffer from raw SIF_CMD_INIT_CMD traffic.
• Return the IOP-side SIF_CMD_SET_SREG response that completes RPC initialization.
• Deliver only the generated SIF0 reply immediately while keeping ordinary SIF DMA interrupts deferred.

Rationale

Games that issue raw sifcmd traffic bypass the existing RPC HLE path. Without the IOP-side initialization response, they can spin forever waiting for SREG 0. Raw transfers targeting destination zero also represent the IOP sifcmd endpoint rather than EE address zero.

Scope

This models only the protocol-level initialization handshake. It does not add raw RPC service emulation or change the channel used for ordinary outgoing SIF DMA. PR #221 contains broader SIF RPC work in those areas.

Validation

• Full test suite: 426 passed, 0 failed.
• Katamari Damacy startup smoke test advances past the SIF initialization wait.