Hi,
Regarding the store operation inside the NOR Flash, you can save the app code inside any address you want to (inside the capabilities of your storage device).
You can do this by changing the Start Address inside the IVT tool. The only section that cannot be moved is the IVT Table itself, every other section should be movable.
Regarding on the selection of the boot target, this is to tell the system which core will take over once the Boot Core (HSE_M7_Core, not M7_0 nor A53_0) finishes the setup. This is where the user application code is to be run in.
Regarding the storage of both the M7 app and the A53 uboot in the same flash, there will be restrictions on which core will have access to the QSPI peripheral, and the need of a synchronization mechanism for both the M and the A core to share this peripheral. The use case of running some code in the M core and uboot in the A core is to use the NOR Flash for the M Core application code and the eMMC/SD for the A Core uboot.
If there is a need of saving both in the same storage device, aside from modifying uboot to boot from a QSPI device, the end user will need to merge both images in a single binary and load it to the IVT tool. At this moment, I'm not aware of a way to save 2 images in the same device within the provided IVT Tool.
There is an Application Note [AN12422 S32G2 Boot Process, Rev. 5, 07/2022] talking about the boot process of the S32G2 platform. Maybe could give a better insight on what can be done during the boot process of the platform.
Please, let us know if this information helps you or not.