zephyr-cp: fix Pico 2 W BLE bring-up found on hardware

Four changes needed to get BLE actually working on a Pico 2 W, all found
by bisecting the failures over SWD.

The settings partition was 2K at 0x180800 — neither erase-sector aligned
nor large enough for one of the RP2350's 4K sectors. flash_area_get_sectors()
returned zero sectors, settings_nvs then computed its sector size from an
uninitialised struct and failed with -EDOM, so bt_enable() returned -33
before ever opening the HCI driver. That surfaced as a bare "OSError: 33"
from "import _bleio", which is where the adapter is enabled (the _bleio
module's __init__ calls common_hal_bleio_adapter_set_enabled). main has
since grown it to one aligned 4K sector at 0x17f000, which fixes the -EDOM
but is still one sector short: nvs_mount() rejects fewer than two sectors
with -EINVAL. Give settings two sectors at 0x17e000, taking the extra one
from the code partition. nvm and circuitpy stay at 0x180000 and 0x181000,
where cptools/check_partitions.py requires them to match
ports/raspberrypi, so the CIRCUITPY filesystem is not moved.

A board whose settings sectors hold content from a previous layout then
fails differently: NVS reads it as "all sectors closed" and refuses to
mount with -EDEADLK. CONFIG_NVS_INIT_BAD_MEMORY_REGION lets it reclaim a
region it does not recognise, so the first boot after a layout change
recovers on its own instead of needing a manual erase over SWD.

The CYW43439's BT controller firmware (CYW4343A2_001.003.016.0065.0000)
does not implement the Bluetooth 5 extended advertising/scanning commands.
It rejects LE Set Extended Scan Parameters (0x2041) with status 0x01
"Unknown HCI Command", so scanning failed with -EIO. The port defaults
BT_EXT_ADV on, which is right for the nRF parts but wrong here, so turn it
off for this board and let the host use the legacy 0x200B/0x200C commands.

Also raise the system workqueue stack and enable HW_STACK_PROTECTION (the
MPU turned several silent corruptions into clean, named faults while
debugging this), and enable BT HCI driver/host debug logging in
debug.conf.

Verified on hardware: patchram loads over the shared gSPI bus, the
controller reports BD_ADDR 2C:CF:67:B7:62:AC (= WiFi MAC + 1), and a scan
returns nearby advertisers by name. That run used the earlier layout with
settings at 0x181000; the 0x17e000 placement is build-tested only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: tyeth

ports/zephyr-cp/boards/raspberrypi/rpi_pico2_w_zephyr/board.conf

@@ -27,3 +27,11 @@ CONFIG_MBEDTLS_CTR_DRBG_C=y
 # instead of silently corrupting neighbouring stacks.
 CONFIG_HW_STACK_PROTECTION=y
 CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
+
+# The CYW43439's BT controller firmware (CYW4343A2_001.003.016.0065.0000) does
+# not implement the Bluetooth 5 extended advertising/scanning commands: it
+# rejects LE Set Extended Scan Parameters (0x2041) with status 0x01 "Unknown
+# HCI Command", so scanning fails with -EIO. The port defaults BT_EXT_ADV on,
+# so turn it off here to make the host use the legacy 0x200B/0x200C scan and
+# legacy advertising commands instead.
+CONFIG_BT_EXT_ADV=n

ports/zephyr-cp/boards/raspberrypi/rpi_pico2_w_zephyr/board.overlay

@@ -6,14 +6,25 @@
 		code_partition: partition@0 {
 			compatible = "zephyr,mapped-partition";
 			label = "code-partition";
-			reg = <0x0 0x17f000>;
+			reg = <0x0 0x17e000>;
 			read-only;
 		};
 
-		storage_partition: partition@17f000 {
+		/*
+		 * The settings partition backs Bluetooth bond keys via NVS, so it
+		 * must be erase-sector aligned and hold at least two of the
+		 * RP2350's 4K sectors: nvs_mount() rejects a single sector with
+		 * -EINVAL, which makes bt_enable() fail before ever opening the HCI
+		 * driver and surfaces as a bare OSError from "import _bleio".
+		 *
+		 * nvm and circuitpy must stay where ports/raspberrypi puts them
+		 * (cptools/check_partitions.py enforces this), so the second sector
+		 * comes out of the code partition, not out of the CIRCUITPY drive.
+		 */
+		storage_partition: partition@17e000 {
 			compatible = "zephyr,mapped-partition";
 			label = "storage";
-			reg = <0x17f000 0x1000>;
+			reg = <0x17e000 0x2000>;
 		};
 
 		nvm_partition: partition@180000 {

ports/zephyr-cp/debug.conf

@@ -51,3 +51,10 @@ CONFIG_IDLE_STACK_SIZE=1024
 # haven't overflowed — left at their defaults.)
 CONFIG_BT_RX_STACK_SIZE=4096
 CONFIG_BT_LONG_WQ_STACK_SIZE=4096
+
+# Bluetooth HCI: driver + host-core debug logging. The CYW43 shared-bus
+# transport logs its patchram download and bring-up at INF/DBG, and the host
+# core logs the command/event exchange — both invisible at the default
+# LOG_MAX_LEVEL. Needed to see how far controller bring-up gets when it fails.
+CONFIG_BT_HCI_DRIVER_LOG_LEVEL_DBG=y
+CONFIG_BT_HCI_CORE_LOG_LEVEL_DBG=y

ports/zephyr-cp/prj.conf

@@ -76,3 +76,11 @@ CONFIG_PSA_WANT_ALG_SHA_256=y
 CONFIG_NVS=y
 CONFIG_SETTINGS_NVS=y
 CONFIG_SETTINGS_NVS_SECTOR_COUNT=256
+
+# A board upgraded from a layout without a settings partition (or one that
+# moved) has whatever the previous image left in those sectors. NVS reads that
+# as "all sectors closed" and refuses to mount with -EDEADLK, which surfaces as
+# bt_enable() failing before the HCI driver is ever opened. Let it reclaim a
+# region it does not recognise instead, so first boot after a layout change
+# recovers on its own rather than needing a manual erase.
+CONFIG_NVS_INIT_BAD_MEMORY_REGION=y