Update CIRCT lock to 6f649f63b (llvm aa3d6b37c794)

Picks up all pending sim fixes since 6334424e. The mux case
binary-literal bug (sel=1/2 always outputting last case arm) is
still present — tracked separately for a CIRCT-side fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: thomasahle

scripts/toolchain.lock.sh

@@ -7,8 +7,8 @@ readonly NODE_MAJOR_VERSION_LOCKED="22"
 readonly EMSDK_VERSION_LOCKED="4.0.21"
 
 readonly CIRCT_REPO_LOCKED="https://github.com/thomasnormal/circt.git"
-readonly CIRCT_REF_LOCKED="6334424eee194b21b9b33148742071e8201fbbc2"
-readonly CIRCT_LLVM_SUBMODULE_REF_LOCKED="972cd847efb20661ea7ee8982dd19730aa040c75"
+readonly CIRCT_REF_LOCKED="6f649f63b8be09c8dbb5cd5b9bd56e1ef0e1d9b1"
+readonly CIRCT_LLVM_SUBMODULE_REF_LOCKED="aa3d6b37c7945bfb4c261dd994689de2a2de25bf"
 
 readonly SURFER_ARTIFACT_URL_LOCKED="https://gitlab.com/surfer-project/surfer/-/jobs/artifacts/main/download?job=pages_build"
 readonly SURFER_ARTIFACT_SHA256_LOCKED="2a684122436e7a7729cc4e57062fdc2ce8ec5fa096d84ca383dd59011012b873"