secure-boot

Anti-rollback check: ```c // REQ-SBOOT-ROLL-02; TEST-SBOOT-06 if (m->version < stored_version()) { return false; // reject rollback } ```