I heard back from P&E Micro (they were very helpful, and responded quickly):
In short, the memory map available is from $8000-$1ffff. The bootloader expects
the loaded application to have it's vector table at address $8000 which is
where we fetch the "reset vector" for your application. You have full control
of everything on the processor (including all ram and peripherals) with the
exception of flash ranges $0000-$7FFF. One of the first operations your
application should perform if you want to use interrupts is to set the SCB_VTOR
register to point to your vector table (presumably at address $8000).
So, an SREC origin'd at 0x8000 should do the trick.