[aidangarske]

• Adds config/examples/mcxn-tz-wolftrust.config: TrustZone secure application handoff on the MCXN947, ECC256/SHA256, record at 0x30030000.
• Partitions sit at the Secure flash alias (boot 0x10040000, update 0x10180000, swap 0x101C0000); the flash HAL maps the alias to the ROM API flash offset.
• hal/mcxn.c uses the shared hal_sau_init() with no Non-secure regions and skips periph_unsecure() for secure-app builds, so the payload stays Secure.
• The Makefile builds wolfboot.bin only for MCXN secure-app builds, like stm32h5 and imx_rt7xx, since factory.bin cannot span the 256MB alias.
• Adds an m33mu MCXN947 emulator app (ROM API flash writes, write-once flags) and mcxn-emulator-tests.yml; the app checks the handoff record against its own HDR_SHA256 on every boot.
• make test-emu now stops with a message for secure-app configs, which need wolfBoot to boot the payload.
• Emulator CI needs the m33mu MCXN947 RAM attribution fix in the wolfboot-ci-m33mu image; the current model denies Secure-alias RAM from reset.
• Tested on FRDM-MCXN947: boot with handoff record verified over SWD, v1 to v4 swap and confirm, v4 to v3 downgrade refused, unconfirmed v7 rolled back to v4.
• Tested with test-app/emu-test-apps/test.sh on patched m33mu: all scenarios pass with handoff=ok on factory, update and fallback boots; mcxn, mcxn-tz, mcxn-wolfcrypt-tz and mcxn-tz-psa still build with no warnings.

needs danielinux/m33mu#23