Hello,
My understanding of your response to Question 2 :
when BOOT_SEQ == 1 and APPBL verify OK ,coreX(X according to IVT_BCW config) will run from APPBL(0x30 in IVT).
when BOOT_SEQ == 1 and IVT is valid ,coreX will run from "CM7_x Application reset address" in IVT ,Did I understand it correctly?
Hmm, this is some SW implementation as uC only refer to IVT for boot. If that is the case please refer to the documentation of that SW.
uC scans for valid IVT starting from lowest address and boot one it find it.

for Question 3&4 :
I was wondering ,When I use BSB and AppBL verified OK,Does “CM7_x Application reset address” config in IVT still useful, does anyone use it?
“CM7_x Application reset address” should point to AppBL Tag (0x00 APPBL struct) or AppBL Content(0x40 AppBL struct)?
Hard to say, this is SW implementation.
From HW point, the device will scan for IVT. once it find it process it and set boot according the settings in IVT. After it it will jump to address of cores in IVT and leave reset. Further on it is all in hands of SW, so for every application it will be different..
Usually you will always use the bootloader in IVT, and will perform branch to application from bootloader by SW.
Best regards,
Peter