Split the AArch64 keystore band so vault, crypto and attestation meet isolation level 3

[aidangarske]

Context

The vault, crypto (SERVICE_HSM) and attestation partitions share one writable keystore band, inherited from main's core, so on AArch64 those three hold isolation level 2 while the manifest declares 3. The core level-3 work is proceeding on main; the AArch64 port follows it.

Origin

PR #29; docs/FF-A-Compatibility.md "Known gap"; Skoll FF-M lens

What is needed

• Private vault, crypto and attestation bands in port/qemuvirt and port/versal manifests with SPMC linker placement
• The core level 3 changes from main carried to the AArch64 SPMC and its S-EL0 partitions, including the IPC doors
• Partition id expectations in positive-secure and confboot updated for the new layout

Blockers and dependencies

#29 and the core level 3 issues on main.

Acceptance criteria

• New QEMU negatives where each of the three partitions touching another's band faults
• The manifest generator and runtime validator refuse a shared writable band at level 3
• confboot 85/4/0 and positive on virt with both engines; the known-gap row removed

[aidangarske]

W1 progress, on wolfTrust-dev2 (#29):

• 243387fe Split the AArch64 keystore band into private vault, attestation and crypto bands. Adds the bandneg1 to bandneg6 twins.
• ef735849 Keep the read-only wolfCrypt globals in the AArch64 constant data.
• f7735be9 Validate partition-to-partition separation on every AArch64 boot.

Remaining: W5, which switches the qemuvirt manifests to isolation level 3 and removes the known-gap row. This issue closes with W5.

[aidangarske]

Landed on wolfTrust-dev2 (#29), W5:

• 1f633133 makes the qemuvirt manifests declare isolation level 3. With W1's private bands, every boot validates them under the level 3 rules, including the partition-to-partition check. The host profile test now expects Level 3 on the fenced port. Porting.md and FF-A-Compatibility.md now say only xlnx-versal-virt claims no level, because its model has no XMPU, RISAF or XPPU fence.

Tested at 1f63313:

• Full QEMU suite: 58 pass on virt GICv3 with the hsm engine, and 55 pass on virt GICv2 with the native engine. The only skips are the expected per-cell ones.
• FF-A ACS: 7/7 on both cells.
• Host make test passes.
• Skoll review and review-security are clean.

Remaining: none for W1 and W5. xlnx-versal-virt stays at profile 0 until #45.