Make native wolfCrypt the default crypto engine and wolfHSM optional

[aidangarske]

Adds a native wolfCrypt secure crypto engine, selected by WT_ENGINE=native (new default); WT_ENGINE=hsm links the wolfHSM server as an opt-in add-on. It uses Identical Non-secure to Secure boundary in both engines: same five CMSE FF-M veneers, service IDs, generated manifest, and L3 isolation bands.

• Engine binds at the existing SERVICE_HSM relay submit seam, so no veneer, S
  ID, or manifest changes.
• Native keys are vault NVM objects stored SENSITIVE and NONEXPORTABLE; private material never leaves the privileged vault domain.
• Attestation IAK is a vault key signed with wc_ecc.
• Shared NVM object store and anti-rollback floors extracted into an engine-independent module used by both engines.
• Non-secure guests run wolfCrypt locally, crossing to the Secure world only for DRBG seed material, vault-backed keys, storage, attestation, and firmware update.
• Measured on STM32H563 (arm-none-eabi-gcc 13.2.1, -Os, secure image): native 86,912 bytes flash and 27,253 bytes static RAM, versus 106,432 and 59,073 for wolfHSM.
• Both engines keep zero heap allocation and exactly five NSC veneers, enforced at link time.
• CI runs every M33MU scenario under both engines and builds both secure images in cross-compile.
• Testing: CI green on this branch head (M33MU matrix 61/61 jobs both engines, cross-compile, unit-tests); H5 NUCLEO-H563ZI
  silicon native positive, restart, crossdomain, and FF-M conformance; skoll review and review-security clean; host make test
  including new native_wire and native_wire_client suites.
• Stacked on Reduce secure-image static RAM by right-sizing the IPC and stack pools #8 (RAM diet) and Lower the coroutine tasklet stack to a measured 10K floor #9 (stack floor); the compare shows their commits until those merge.

Secure image (STM32H563, -Os)	Flash	Static RAM
Native wolfCrypt engine (default)	86,912	27,253
wolfHSM engine (opt-in add-on)	106,432	59,073
wolfHSM overhead	+19,520 (+22%)	+31,820 (+117%)

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #17

Scan targets checked: wolftrust-src, wolftrust-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #17

Scan targets checked: wolftrust-src, wolftrust-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[danielinux]

Please rebase