W4: Add the manifest-honesty negatives to the QEMU AArch64 suite

[aidangarske]

Context

Plan item W4 of the AArch64 level 3 plan (tracking #46). The M33MU manifest-honesty negatives (#36) have no QEMU twin yet.

Origin

#36 parity for the AArch64 ports; the AArch64 level 3 plan

What is needed

• manifestneg2: a manifest declaring isolation level 2 is refused at boot
• manifestneg3: a composed table that grants the vault a granule of the crypto partition's band is refused by the boot-time partition separation check

Blockers and dependencies

manifestneg3 needs #43 (W1), which gives each keystore partition a private band and runs the separation check on every AArch64 boot.

Acceptance criteria

• Both twins pass on virt gicv2 a35, virt gicv3 a72 and versal-virt with both engines
• Skoll review and review-security clean on the change

[aidangarske]

Landed on wolfTrust-dev2 (#29):

• 1f87878 adds the manifestneg2 QEMU twin: a manifest declaring isolation level 2 stops the boot with the manifest-validation panic.
• e87bbed adds the manifestneg3 QEMU twin: a vault table granted part of the crypto partition's band is refused by the boot-time separation check, not the table builder, and the boot stops with the same panic.
• 0a62e7f documents both twins in Testing.md.

Remaining: none for W4.