firmware: dual-bank A/B update, P-256 signed images, immutable boot stage

[0xEthamin]

Bring up the whole field-update path: a signed image, an immutable first-stage boot decision, a register-level flash driver, and the host tooling that lays down a bank signed by a hardware-held root key.

• Signature: ECDSA P-256 over SHA-256 replaces Ed25519. The A/B split makes the image non-contiguous, which pure Ed25519 cannot verify without a large RAM copy, so verify runs prehash-native over segments. One verifier ships, the Ed25519 id survives only as a downgrade guard, and low-s is enforced.

• Layout, identical in both banks so no security window reprograms on a swap: metadata 0-1, immutable boot stage 2-8, descriptor 9, secure app 10-19 with the CMSE veneer on page 19, non-secure app 20-31. Both link scripts move onto their bands.

• New crate boot-stage returns exactly one decision (boot, revert, wedge) and bumps the anti-rollback counter LAST. It sits outside the image band, because the new bank's boot stage is what runs the revert. Its pinned anchor product_root_key.sec1 is a PUBLIC key whose private half stays in a hardware token, and the build pins production with no dev-key fallback.

• mcu-flash drives each page through the controller and alias matching its watermark label. The power-fault census moves here onto the register-level model, and the fw-update fidelity and power_fault modules are deleted.

• platform: the non-secure flash region now spans the whole alias, since an uncovered address is fixed secure and that silently broke writes to the active bank's non-secure pages. The secure MPU grows to seven regions, adding a swap-derived metadata region and two inactive-bank updater windows starting at page 9.

• image-signer gains bank assembly and an offline-signature flow, so the private key never enters the tool. Every path compares the signing key to the expected key before laying down a byte.

• scripts/ab-bench.sh automates the bench round trip, brick-safe by construction. The TROPIC01 model pin moves into the driver's own install-model.sh, with a checksum and a post-install version check.