[aidangarske]

• Adds config/examples/mcxn-tz-wolftrust.config: TrustZone secure application handoff on the MCXN947, ECC256/SHA256, record at 0x30030000.
• Partitions sit at the Secure flash alias (boot 0x10040000, update 0x10180000, swap 0x101C0000); the flash HAL maps the alias to the ROM API flash offset.
• hal/mcxn.c uses the shared hal_sau_init() with no Non-secure regions and skips periph_unsecure() for secure-app builds, so the payload stays Secure.
• The Makefile builds wolfboot.bin only for MCXN secure-app builds, like stm32h5 and imx_rt7xx, since factory.bin cannot span the 256MB alias.
• Adds an m33mu MCXN947 emulator app (ROM API flash writes, write-once flags) and mcxn-emulator-tests.yml; the app checks the handoff record against its own HDR_SHA256 on every boot.
• make test-emu now stops with a message for secure-app configs, which need wolfBoot to boot the payload.
• Emulator CI needs the m33mu MCXN947 RAM attribution fix in the wolfboot-ci-m33mu image; the current model denies Secure-alias RAM from reset.
• Tested on FRDM-MCXN947: boot with handoff record verified over SWD, v1 to v4 swap and confirm, v4 to v3 downgrade refused, unconfirmed v7 rolled back to v4.
• Tested with test-app/emu-test-apps/test.sh on patched m33mu: all scenarios pass with handoff=ok on factory, update and fallback boots; mcxn, mcxn-tz, mcxn-wolfcrypt-tz and mcxn-tz-psa still build with no warnings.

needs m33mu/m33mu#23

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #948

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/mcxn-emulator-tests.yml, .github/workflows/test-configs.yml, Makefile, config/examples/mcxn-tz-wolftrust.config, docs/Targets.md, docs/secure_app_handoff.md, test-app/emu-test-apps/Makefile, test-app/emu-test-apps/mcxn947/Makefile, test-app/emu-test-apps/mcxn947/target.ld.in, test-app/emu-test-apps/test.sh
Coverage: 3 of 4 in-scope changed file(s) opened by the reviewer; not opened: test-app/emu-test-apps/mcxn947/uart.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite