How many low-order bits of an RSA modulus can we safely fix to 1? It's easy to generate an RSA modulus $n=p\,q$ of $k$ bits with $n\equiv-1\pmod{2^\ell}$, for $\ell$ up to about $k/2$: we can choose $p$ as usual, fix the $\ell$ low-order bits of $q$ to $-p^{-1}\bmod2^\ell$, and choose $q$ with this constraint. This fixes the low-order $\ell$ bits of $n$ to 1, and thus appreciably simplifies Montgomery arithmetic when using the public key.
As an aside, that could be used to halve the storage requirement for $n$.
Up to what $\ell$ is that safe?
Some $n$ (in hex) for $k\in\{256,512,1024,2048\}$, $l=k/2$, generated using this TiO.
f0e32fe555bf8c5027734fcb32b6d51bffffffffffffffffffffffffffffffff
dec79757c4b1ca15fbe0854a75f38749df4768884c9e9c24af0f09d61a3d1811ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
af8c7235e1938b869a28c310c362444331f19c9b9cc578751a1a8f0859e1ae72916abd7351d82f0ffcb9b84eca441ee37f3646e5890c4ba94f9d6811d4b7f708ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
b22220297783289475800ddba5f2e9cfbdf64f2de3a23f10ac7d191d2f4fee2bba4d01dee6c851e8ed42fa1c4d5cafbec97e19e1735d1350f6b5ec1e26d9ef557c3c8938dc1b831a917337903977f15573f35be50607e6080dac8f967c6e3f1bea171870205d64f8b7263ed7ff20585c38d62505c77d0206dcc4dabeda45dd11ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
Consider the similar RSA key generation process:
Select a random odd value $z$ between 1 and $2^\ell - 1$; choose $p$ as usual, fix the lower $\ell$ bits of $q$ to $z p^{-1} \bmod 2^\ell$ and chose $q$ with this constraint.
Now, this generates RSA keys with the same asymptotic [1] distribution as the standard RSA key generation process.
Now, the only difference between this procedure and yours is that you use a fixed $z = 2^\ell -1$, rather than a random one.  However, the attacker can determine the value $z$ used, and so us telling him which $z$ we picked doesn't give him any additional information.
So, the only question is &quot;does a specific value of $z$ yield a weakness?&quot;.  I do not know of any factoring method that is applicable to a specific $z$ value.

[1]: I say asymptotic, as the demonstration assumes that the lower $\ell$ bits of primes are evenly distributed over odd values; this has been proven to be true asymptopicly (for fixed $\ell$), it is a reasonable (but unproven) assumption for smaller primes.