[BUG] `fsqrt.h` NaN Canonicalization Bug

Is there an existing CVA6 bug for this?

I have searched the existing bug issues

Bug Description

This report captures a divergence where CVA6 clears the payload bits of a NaN that should have been canonicalized. When executing fsqrt.h f21, f19, rne with the setup below, Spike and Rocket both leave the canonical half-precision NaN (0xffffffffffff7e00), while CVA6 overwrites it with 0xffffffffffff0000.

f19 = 0x4000000000000000 (input that fails the NaN-boxing check for half precision)
f21 = 0xffffffffffff7e00 (destination preloaded with canonical half-precision NaN)

Expected behavior: f21 remains 0xffffffffffff7e00.
Observed on CVA6: f21 becomes 0xffffffffffff0000, indicating the NaN payload is being zeroed instead of being canonicalized.

li x2, 0x4000000000000000
fmv.d.x f19, x2
li x2, 0xffffffffffff7e00
fmv.d.x f21, x2
fsqrt.h f21, f19, rne

After executing fsqrt.h, inspect f21. Reference simulators retain the canonical NaN, whereas CVA6 strips the payload bits, breaking the RV64 NaN-boxing requirements for half-precision square root results fed by non-NaN-boxed operands.