[Codegen][CPU] Route inner_tiled broadcast into m_bcst-foldable slot. (#24516)

The CPU `inner_tiled` lowering replicates whichever of LHS/RHS has fewer
lanes up to the other's lane count before calling the LLVM intrinsic.
The previous lowering emitted this as `vector.broadcast` to a
`(replicate, K)` 2-D shape followed by `vector.shape_cast` to flat, with
a comment claiming the x86 backend's instruction selector would recover
the `{1toN}` broadcast-from-memory form on its own.

Empirically that did not work for bf16 matmul codegen on Zen 4: every
`vdpbf16ps` instruction was preceded by a separate `vbroadcastss`,
doubling the per-row uop count of the hot inner loop. Two structural
reasons:

1. The IR shape mattered. LLVM's x86 ISel `m_bcst` patterns key on the
canonical `_mm512_set1_ps`-style splat: a scalar fed into `insertelement
<N x T> poison, T, 0` followed by `shufflevector <N x T>, poison, <N x
i32> zeroinitializer`, with `T` a float. Our `vector.broadcast` to a
`(replicate, K)` 2-D shape + `vector.shape_cast` lowered to a different
shufflevector pattern (or a direct `<K x elem> -> <N*K x elem>`
interleaved shuffle) that did not pattern-match.

2. The intrinsic operand position mattered. The ISA-level `m_bcst` EVEX
operand is on the *third* source of `dpbf16ps`/`vpdpwssd`/ `pmaddwd`,
and on the `b` operand (second multiplicand) of FMA's `a*b+c`. We passed
the broadcasted operand into the LHS slot, putting it where ISel cannot
fold a memory broadcast.

Rewrite the replication to bitcast the source to a 1-lane vector of
width `K * elem_bits` (with a float lane type when that width is 32 or
64 bits, matching the `_mm512_set1_ps` shape), extract the scalar,
`vector.broadcast` it to `replicate` lanes, then bitcast back. Track
whether the broadcast landed on lhs and, for the symmetric LLVM
intrinsics, route the broadcasted operand into the m_bcst-foldable slot.
For K=1 the bitcast pair is a no-op LLVM elides. vpdpbusd is asymmetric
(UI8 must stay in the second slot); its existing sign-aware routing
happens to put the broadcast in the m_bcst slot precisely in the two
orientations where the ISA allows the fold, so no change needed there.

Measured on a 4096×4096 dynamic-shape bf16×bf16 -> f32 matmul on Zen 4
(avx512_bf16, no AMX), with `--iree-opt-data-tiling
--iree-llvmcpu-enable-inner-tiled`:

- All 29 `vdpbf16ps` in the inner loop now use the `{1to16}`
memory-broadcast form (vs 0 before); all 29 separate `vbroadcastss` are
gone.
- End-to-end matmul: 80.8 ms -> 62.7 ms (1.29x faster, 16.0 it/s -> from
12.4 it/s), closing ~60% of the gap to the precompiled mmt4d ukernel
(50.5 ms).

Progress towards #24515.

Signed-off-by: Benoit Jacob <jacob.benoit.1@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>