python3-improv: report secure_boot from U-Boot sec_boot flag (imx93-jaguar-eink)

[ajlennon]

Summary

sec.secure_boot in the Device-Status sec block previously always returned "unknown". This implements a best-effort userspace read.

• Why not the ELE lifecycle? The authoritative source is the EdgeLock Enclave "get info" lifecycle field (OEM_OPEN / OEM_CLOSED / FIELD_RETURN). This kernel exposes no userspace ELE path — no /dev/ele_mu, no lifecycle nvmem cell; the lifecycle lives behind OP-TEE/secure world. Reading it authoritatively needs a dedicated OP-TEE TA (secure-world plumbing) — kept as a tracked follow-up (roadmap P0-1/P2-1, BLE-BOARD-PROFILE.md §10).
• What we read instead: U-Boot's sec_boot env flag via fw_printenv, which the NXP boot script uses to gate authenticated boot (auth_os): yes → closed, no → open, otherwise unknown. This reflects the bootloader configuration, not an ELE-attested hardware lifecycle, and (like the whole sec block) is self-reported/untrusted until attestation (P2-1).
• A fuse/OCOTP byte heuristic is deliberately avoided — the ELE-OCOTP0 shadow has non-zero UID/config words, so byte-level guessing would misreport a fused board.

Test plan

• fw_printenv -n sec_boot on eink-0167 (root) → no → secure_boot: "open".
• python3 -m py_compile passes.
• Hot-patch on eink-0167 and confirm via improv_provision.py info --json that sec.secure_boot reads open over BLE (post-merge OTA re-verify).

Made with Cursor