docs: add v6.2 migration guide entry for bootloader PMP ownership change

The second stage bootloader no longer configures or locks PMP entries on
C5, C6, C61, H2 and P4; document the impact on non-ESP-IDF applications
launched by the ESP-IDF bootloader that relied on the bootloader-provided
PMP configuration.

docs/en/migration-guides/index.rst

@@ -24,3 +24,4 @@ ESP-IDF 6.x Migration Guide
 
     release-6.x/6.0/index
     release-6.x/6.1/index
+    release-6.x/6.2/index

docs/en/migration-guides/release-6.x/6.2/index.rst

@@ -0,0 +1,9 @@
+Migration from 6.1 to 6.2
+--------------------------
+
+:link_to_translation:`zh_CN:[中文]`
+
+.. toctree::
+    :maxdepth: 1
+
+    security

docs/en/migration-guides/release-6.x/6.2/security.rst

@@ -0,0 +1,15 @@
+Security
+========
+
+:link_to_translation:`zh_CN:[中文]`
+
+Memory Protection
+-----------------
+
+Starting from **ESP-IDF v6.2**, on ESP32-C5, ESP32-C6, ESP32-C61, ESP32-H2, and ESP32-P4 the second stage bootloader no longer configures or locks any RISC-V PMP entries. The complete PMP configuration is now programmed and locked by the application during early startup.
+
+A PMP entry locked by the bootloader cannot be reconfigured until the next CPU reset. Since the bootloader on a deployed device is generally never updated, entries locked by an older bootloader could conflict with the PMP layout expected by an application built with a newer ESP-IDF version, leading to boot failures or to memory protection being silently inactive.
+
+Applications built with ESP-IDF are not affected, as they program and lock the full PMP configuration themselves during startup, before any application code runs.
+
+Custom (non-ESP-IDF) applications launched by the ESP-IDF second stage bootloader must not assume that any PMP entries are pre-configured or locked at handoff. Previously, the bootloader configured and locked entries covering, e.g., the ROM and the peripheral address spaces; such applications must now program their own PMP configuration.

docs/zh_CN/migration-guides/index.rst

@@ -24,3 +24,4 @@
 
     release-6.x/6.0/index
     release-6.x/6.1/index
+    release-6.x/6.2/index

docs/zh_CN/migration-guides/release-6.x/6.2/index.rst

@@ -0,0 +1,9 @@
+从 6.1 迁移到 6.2
+------------------
+
+:link_to_translation:`en:[English]`
+
+.. toctree::
+    :maxdepth: 1
+
+    security

docs/zh_CN/migration-guides/release-6.x/6.2/security.rst

@@ -0,0 +1,15 @@
+安全性
+======
+
+:link_to_translation:`en:[English]`
+
+内存保护
+--------
+
+从 **ESP-IDF v6.2** 开始，在 ESP32-C5、ESP32-C6、ESP32-C61、ESP32-H2 和 ESP32-P4 上，二级引导加载程序不再配置或锁定任何 RISC-V PMP 表项。完整的 PMP 配置改由应用程序在启动早期编程并锁定。
+
+被引导加载程序锁定的 PMP 表项在下一次 CPU 复位前无法重新配置。由于已部署设备上的引导加载程序通常不会更新，旧版引导加载程序锁定的表项可能与使用较新 ESP-IDF 版本构建的应用程序所期望的 PMP 布局发生冲突，导致启动失败，或使内存保护在没有任何提示的情况下失效。
+
+使用 ESP-IDF 构建的应用程序不受影响，因为应用程序会在启动阶段、任何应用代码运行之前，自行编程并锁定完整的 PMP 配置。
+
+由 ESP-IDF 二级引导加载程序启动的自定义（非 ESP-IDF）应用程序不得假定交接时任何 PMP 表项已被预先配置或锁定。此前，引导加载程序会配置并锁定覆盖 ROM 和外设地址空间等区域的表项；此类应用程序现在必须自行完成 PMP 配置。