test: inject saturation bug for CI validation

rtl/pwm_control_demo.v

@@ -30,7 +30,7 @@ module pwm_control_demo (
     // ---------------------------------------------------------
     always @(*) begin
         if (cmd > 8'sd90)
-            limited_cmd = 8'sd90;
+            limited_cmd = 8'sd91;
         else if (cmd < -8'sd90)
             limited_cmd = -8'sd90;
         else