[Runtime] Add a Debug Image flag to the SoC manifest

[mhatrevi]

Please include the following information

• Caliptra Version(s): 2.x
• Caliptra Mode: Subsystem Mode

Summary

Add a manifest-level Debug Image bit to the existing SoC authorization manifest preamble flags field. A SoC manifest marked for debug use must only be accepted by Runtime when subsystem Debug Intent is asserted.

Required behavior

Debug Image flag	SS_DEBUG_INTENT	Runtime behavior
Clear	Clear or set	Preserve existing behavior
Set	Set	Continue normal SoC manifest verification
Set	Clear	Reject the SoC manifest

The flag must not bypass or weaken any existing authorization, signature, SVN, digest, or image checks.

Acceptance criteria

• Allocate and document an available bit in AuthManifestPreamble.flags as Debug Image.
• Expose the flag through the SoC authorization-manifest types and generation tooling.
• During SET_AUTH_MANIFEST processing, check SS_DEBUG_INTENT whenever the Debug Image bit is set.
• If Debug Intent is not asserted, return a clear Runtime error and do not install or persist the manifest.
• Apply the policy consistently to verify-only and manifest-install paths.
• Add positive and negative Runtime tests covering the behavior matrix above.